# Cisco XDR V2 API

**Canonical:** https://apis.io/apis/cisco-xdr/cisco-xdr-v2-api/  
**Provider:** Cisco XDR — https://apis.io/providers/cisco-xdr/  
**Base URL:** https://private.intel.amp.cisco.com  
**Documentation:** https://developer.cisco.com/docs/cisco-xdr/

Cisco XDR V2 API is one of 83 APIs that [Cisco XDR](https://apis.io/providers/cisco-xdr/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include v2. The published artifact set on APIs.io includes an OpenAPI specification.

The v2 API from Cisco XDR — 75 operation(s) for v2.

## Operations (60 of 85)

| Method | Path | Summary |
|---|---|---|
| POST | `/v2/casebook` | Adds a new Casebook |
| GET | `/v2/casebook/external_id/{external-id}` | List Casebook by external id |
| GET | `/v2/casebook/search` | Search casebooks |
| GET | `/v2/casebook/{casebook-id}` | Get one casebook by id |
| PUT | `/v2/casebook/{casebook-id}` | Updates a Casebook |
| DELETE | `/v2/casebook/{casebook-id}` | Deletes a Casebook |
| PATCH | `/v2/casebook/{casebook-id}` | Partially Update a Casebook |
| GET | `/v2/casebook/{casebook-id}/summary` | Returns a casebook and it's related incidents. |
| POST | `/v2/casebook/{casebook-id}/observables` | Updates a casebook's observables |
| POST | `/v2/casebook/{casebook-id}/bundle` | Updates a casebook's bundle |
| POST | `/v2/casebook/{casebook-id}/texts` | Updates a casebook's texts |
| POST | `/v2/investigation` | Create Investigation |
| POST | `/v2/investigation/bundle` | Create Investigation from Snapshot |
| POST | `/v2/investigation/snapshot` | Create Investigation from Snapshot |
| GET | `/v2/investigation/{investigation-id}/snapshot` | Create Investigation from Investigation Id |
| GET | `/v2/investigation/{investigation-id}/errors` | Investigation Errors |
| GET | `/v2/investigation/{investigation-id}/entities` | Investigation Entities |
| GET | `/v2/investigation/{investigation-id}/events` | Investigation Events |
| GET | `/v2/investigation/{investigation-id}/verdicts` | Investigation Verdicts |
| GET | `/v2/investigation/{investigation-id}/graph` | Investigation Relation Graph |
| GET | `/v2/investigation/{investigation-id}/indicators` | Returns a list of indicators attached to this investigation |
| GET | `/v2/investigation/{investigation-id}/observables` | Returns a list of observables attached to this investigation |
| GET | `/v2/investigation/{investigation-id}/overview` | Returns metadata about the investigation |
| GET | `/v2/investigation/{investigation-id}/status` | Investigation Status |
| GET | `/v2/investigation/{investigation-id}/summary` | Returns a Summary of the Investigation |
| GET | `/v2/investigation/{investigation-id}/targets` | Returns a list of targets attached to this investigation |
| POST | `/v2/investigation/{investigation-id}/bundle` | Add Threat context to an investigation |
| POST | `/v2/investigation/{investigation-id}/observable/add` | Add observables to an investigation |
| POST | `/v2/investigation/{investigation-id}/observable/remove` | Remove observables from an investigation. |
| POST | `/v2/investigation/{investigation-id}/task` | Run a task |
| PUT | `/v2/investigation/{investigation-id}/edit` | Saves an investigation in place. |
| POST | `/v2/investigation/{investigation-id}/copy` | Create a copy of an investigation. |
| DELETE | `/v2/investigation/{investigation-id}/delete` | — |
| POST | `/v2/investigation/{investigation-id}/save-as` | Saves an investigation as a new entity. |
| POST | `/v2/incident` | Create New Incident |
| POST | `/v2/incident/delete` | Delete Bulk Incidents |
| GET | `/v2/incident/search` | Search incidents |
| GET | `/v2/incident/search/count` | Get Count of Incidents by Search |
| GET | `/v2/incident/{incident-id}` | Get one incident. |
| PUT | `/v2/incident/{incident-id}` | Update one incident. |
| DELETE | `/v2/incident/{incident-id}` | Delete one incident. |
| PATCH | `/v2/incident/{incident-id}` | Patch one incident. |
| POST | `/v2/incident/{incident-id}/actions-taken` | Post actions taken for an incident |
| POST | `/v2/incident/{incident-id}/link/{entity-type}/{entity-id}` | Link incident and entity (investigation \| casebook \| incident) |
| DELETE | `/v2/incident/{incident-id}/link/{entity-type}/{entity-id}` | Unlink incident and entity. (investigation \| casebook \| incident) |
| POST | `/v2/incident/{incident-id}/update-context` | Process an incident update by invalidating the cache and finding reputations as well as resolving assets. |
| GET | `/v2/incident/{incident-id}/report` | Incident Report |
| GET | `/v2/incident/{incident-id}/report/{section-id}` | Incident Report Section |
| POST | `/v2/incident/{incident-id}/report/{section-id}` | Update Report Section |
| POST | `/v2/incident/{incident-id}/report/{section-id}/regenerate` | Regenerate a Report Section |
| GET | `/v2/incident/{incident-id}/summary` | Full Incident Summary. Equivalent Data to v1 summary endpoints. |
| GET | `/v2/incident/{incident-id}/mitre` | Mitre tactics, techniques, and subtechniques found in an incident |
| GET | `/v2/incident/{incident-id}/targets` | Incident Assets |
| GET | `/v2/incident/{incident-id}/observables` | Returns a list of observables linked to this incident. |
| GET | `/v2/incident/{incident-id}/indicators` | Returns a list of indicators linked to this incident. |
| GET | `/v2/incident/{incident-id}/entities` | Returns a list of entities associated with this incident. |
| GET | `/v2/incident/{incident-id}/events` | Returns a list of events linked to this incident. |
| POST | `/v2/incident/{incident-id}/events` | Returns a list of events linked to this incident. |
| GET | `/v2/incident/{incident-id}/status` | Returns the underlying incident's investigation status with surrounding threat context. |
| POST | `/v2/incident/{incident-id}/status` | Update an incident status. |

…and 25 more operations. They are listed in full on the page.

## Machine-readable artifacts (1)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/openapi/cisco-xdr-v2-api-openapi.yml

## Other Cisco XDR APIs (12)

- [Cisco XDR Actor API](https://apis.io/apis/cisco-xdr/cisco-xdr-actor-api/)
- [Cisco XDR Asset API](https://apis.io/apis/cisco-xdr/cisco-xdr-asset-api/)
- [Cisco XDR Asset Mapping API](https://apis.io/apis/cisco-xdr/cisco-xdr-asset-mapping-api/)
- [Cisco XDR Asset Properties API](https://apis.io/apis/cisco-xdr/cisco-xdr-asset-properties-api/)
- [Cisco XDR Attack Pattern API](https://apis.io/apis/cisco-xdr/cisco-xdr-attack-pattern-api/)
- [Cisco XDR Bulk API](https://apis.io/apis/cisco-xdr/cisco-xdr-bulk-api/)
- [Cisco XDR Bundle API](https://apis.io/apis/cisco-xdr/cisco-xdr-bundle-api/)
- [Cisco XDR Campaign API](https://apis.io/apis/cisco-xdr/cisco-xdr-campaign-api/)
- [Cisco XDR Casebook API](https://apis.io/apis/cisco-xdr/cisco-xdr-casebook-api/)
- [Cisco XDR COA API](https://apis.io/apis/cisco-xdr/cisco-xdr-coa-api/)
- [Cisco XDR Deliberate API](https://apis.io/apis/cisco-xdr/cisco-xdr-deliberate-api/)
- [Cisco XDR Event API](https://apis.io/apis/cisco-xdr/cisco-xdr-event-api/)

## Tags

v2

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/cisco-xdr/cisco-xdr-v2-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/cisco-xdr/.