Cisco XDR

Cisco XDR is Cisco's extended detection and response platform, the successor to SecureX. It correlates telemetry from Cisco Secure Endpoint, Secure Firewall, Umbrella, Duo, Secure Email and third-party sources into incidents, and exposes four distinct REST API families behind a single OAuth 2.0 authorization server: the IROH platform (inspect, enrich, response actions, integration modules, events, webhooks) at visibility.amp.cisco.com, the CTIA private-intelligence store at private.intel.amp.cisco.com, the Conure v2 incidents and investigations service at conure.us.security.cisco.com, and the Automation workflow engine at automate.us.security.cisco.com. All four publish anonymously fetchable machine-readable contracts — 52 documents, 581 operations, 1,176 schema definitions — and Cisco additionally ships a 27-tool MCP server through CiscoDevNet, stdio-only. There is no sandbox, no test mode and no idempotency key anywhere, including on the operation that blocks, isolates and quarantines.

Cisco XDR publishes 89 API contracts indexed on the APIs.io network, including Actor API, Asset API, Asset Mapping API, and 86 more. Tagged areas include Security, XDR, Threat Detection, Incident Response, and SOC.

The Cisco XDR catalog on APIs.io includes 1 event-driven AsyncAPI specification and 1 Spectral governance ruleset.

Cisco XDR’s developer surface includes pricing, authentication, developer portal, documentation, API reference, changelog, getting-started guide, and 43 more developer resources.

🌐 Visit website 📡 Profile data on GitHub

69.9/100 exemplar ▬ flat Agent 39/100 agent ready saas Full breakdown ↓
scored 2026-11-06 · rubric v0.27.0 · Show this score on your site →

12 published contracts 1 MCP Servers 3 Agent Skills

Security XDR Threat Detection Incident Response SOC Threat IntelligenceExtended Detection and ResponseOAuth Webhook Automation MCP Authentication

What this lets a business do 2

Business capabilities this provider's published APIs can perform, derived from its own contracts. Browse all capabilities →

Cybersecurity Management

BC-620

ActorAsset PropertiesAttack PatternCOACampaignCasebook

POST /ctia/incident/{id}/status POST /ctia/incident POST /ctia/indicator POST /iroh/iroh-response/respond/sighting

SaaS Tenant Management

BC-4230

Tenants

POST /v2/tenants

Kin Score

Kin Score How this is scored →
scored 2026-11-06 · rubric v0.27.0

Composite quality — 69.9/100 · exemplar

Contract Quality 11.2 / 19

Developer Ergonomics 9.9 / 15

Access Clarity 12.0 / 15

Operational Transparency 7.4 / 10

Contract Governance 1.6 / 9

Discoverability 5.3 / 8

Regulatory Posture 6.8 / 15

Create-or-Update Ergonomics 2.8 / 10

Agent readiness — 39/100 · agent ready

Machine-Readable Contract 18 / 18

Agentic Access Contract 0 / 10

Documented Reversibility 6 / 6

MCP Server 12 / 12

Machine-Readable Auth 10 / 10

Idempotency 0 / 9

Stable Error Semantics 8 / 8

Request/Response Examples 7 / 7

Rate-Limit Signaling 7 / 7

Typed Event Surface 6 / 6

Agent Skills 5 / 5

Well-Known Catalog 0 / 4

Consent & Bot Identity 0 / 3

A2A Agent Card 0 / 8

Dry-Run / Simulate Mode 4 / 4

Delegated User Identity 6 / 6

Protected Resource Metadata 0 / 5

Registration Without a Human 0 / 6

Agentic Commerce Well-Known Document 0 / 5

Pagination 5 / 5

Distinct Operations 3 / 3

MCP Tool Quality 6 / 6

Regulatory Posture applies to this provider. Its tags matched the Horizontal (data, software, accessibility, platform) regime, so Regulatory Posture carries 15 points of the composite. If this regime is wrong for your business, say so on your provider repo — the applicability map is public and we will correct it.

Create-or-Update Ergonomics applies to this provider. This API accepts writes, so it carries 10 points of the composite. It is scored from the published contracts themselves: whether a caller can create-or-update in one call, whether the write accepts a key the caller already holds, and whether the response says which branch ran. Without that, every write needs a search-and-branch in front of it, and the first time that check is skipped a duplicate record is created. Scored against the observed mean rather than raw — a provider at the catalog average is unchanged by this facet, not penalised by it.

The six quality facets above are damped to 75 points between them, because the conditional facet above carries the other 25. That is why each facet's contribution is shown against a damped maximum: raising a quality facet moves the composite by 75% of its nominal weight, not 100%. The full arithmetic is at apis.io/rating/.

Show this score on your site.

It updates itself when the score changes. Paste this where you link to your API docs:

<a href="https://apis.io/providers/cisco-xdr/"><img src="https://apis.io/badge/cisco-xdr/card.svg" alt="Cisco XDR on APIs.io — Kin Score by API Evangelist"></a>

Other styles, a README pill and a shields.io endpoint are on the badge page.

Raise your score.

Agent readiness — checks not met, largest first (exact, from this profile):

Agentic Access Contract +10 pts — agentic_access artifact present (x-agentic-access), graded by author
Idempotency +9 pts — OpenAPI mutating operations declare an idempotency key — a header, a request-body property, or a named de-duplication token whose own description says so (verified); else common[].type matches /idempoten/i (documented)
A2A Agent Card +8 pts — a2a/-a2a.yml manifest, graded on conformance.grade against A2A 1.0.0
Registration Without a Human +6 pts — a `registration_endpoint` in the served RFC 8414 / OIDC discovery document
Protected Resource Metadata +5 pts — a served /.well-known/oauth-protected-resource carrying `resource` (documented), and naming its authorization_servers (verified)
Agentic Commerce Well-Known Document +5 pts — a parsing /.well-known/ucp.json or acp.json declaring a version and at least one service, OR (0.27) a live x402 payment challenge from _data/x402-adoption.json — `self` when its endpoints are on the provider's own domain, `platform` when they are on a vendor's

2 more unmet checks in the Agent Readiness table above.

Kin Score — facets with the most composite points still available (weight × headroom):

Contract Quality scores 59.6 — up to +10.1 composite points
Contract Governance scores 18.2 — up to +9.8 composite points
Developer Ergonomics scores 66.1 — up to +6.8 composite points

Each check links to what satisfies it. Publish the artifact, or tell us where it already lives, and the score moves on the next scoring run.

Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. Every facet and dimension name above is a link: it opens that measurement's own page — what it means, the exact checks that feed it, how the whole catalog distributes on it, and the providers at the top of it. This rating is computed from the provider profile at artifacts.apis.io/cisco-xdr/apis.yml: open an issue on github.com/api-evangelist/cisco-xdr to ask a question or point us at an artifact you publish. Submit an artifact on GitHub — free → Manage your own listing — the Influence plan, $499/mo →

Markets this provider is in provisional

The Kin Score Market layer reads a provider inside its market: its position, and how deep its integrations go. Depth is only comparable within a position. Provisional and unweighted: not part of the Kin Score or agent readiness.

Market	Position	Depth	Registered MCP server	Declares compatibility
Security (EDR, SIEM, SOAR)	builds-on	17.2 (thin)	-	-
Cisco DevNet Ecosystem (builders on Meraki, Catalyst, ISE, ThousandEyes, Splunk)	builds-on	17.2 (thin)	-	-
Browser Extension Stores (company-published Firefox add-ons; Chrome Web Store unreadable)	builds-on	17.2 (thin)	-	-

Registered MCP server and declares compatibility are report only — not weighted. Undeclared means we found nothing we can read, so there is no number: we never infer integrations.

Standards implemented 4

Standards this provider implements or carries. De facto ones are profiled and measured by the API Commons; formal ones come from the standards directory and are linked by the provider's own tags. The evidence column says how each claim was established — not that it was made.

Model Context Protocol (MCP)

measured — observed by APIs.io (documented)

OAuth

tagged — the provider's own APIs.json carries the standard as a tag; implementation not verified

OpenAPI

measured — observed by APIs.io (published)

OAuth 2.0

measured — observed by APIs.io (declared)

APIs 89

Individual APIs this provider publishes, each with its own machine-readable definition.

Cisco XDR Actor API

Actor operations

Cisco XDR Asset API

Asset operations

Cisco XDR Asset Mapping API

Asset Mapping operations

Cisco XDR Asset Properties API

Asset Properties operations

Cisco XDR Attack Pattern API

Attack Pattern operations

Cisco XDR Bulk API

The Bulk API from Cisco XDR — 1 operation(s) for bulk.

Cisco XDR Bundle API

The Bundle API from Cisco XDR — 2 operation(s) for bundle.

Cisco XDR Campaign API

Campaign operations

Cisco XDR Casebook API

Casebook operations

Cisco XDR COA API

COA operations

Cisco XDR Deliberate API

This set of routes allow to quickly get answers from your integrations You might use them at the start of any investigation to quickly get answers from your modules if something...

Cisco XDR Event API

Events operations

Cisco XDR Feed API

Feed operations

Cisco XDR Feedback API

Feedback Routes

Cisco XDR Health API

This set of routes allow to check the health of your integrations setup Verify if your modules are setup correctly and if your credentials are correct.

Cisco XDR Incident API

Incident operations

Cisco XDR Indicator API

Indicator operations

Cisco XDR Inspect API

Inspect related routes

Cisco XDR Investigation API

The Investigation API from Cisco XDR — 8 operation(s) for investigation.

Cisco XDR INVITE API

The INVITE API from Cisco XDR — 2 operation(s) for invite.

Cisco XDR Iroh API

The Iroh API from Cisco XDR — 3 operation(s) for iroh.

Cisco XDR Judgement API

Judgement operations

Cisco XDR LOGIN API

The LOGIN API from Cisco XDR — 4 operation(s) for login.

Cisco XDR Malware API

Malware operations

Cisco XDR Metrics API

The Metrics API from Cisco XDR — 1 operation(s) for metrics.

Cisco XDR Module Instance API

ModuleInstance Routes

Cisco XDR Module Type API

ModuleType Routes

Cisco XDR Module Type Patch API

ModuleTypePatch Routes

Cisco XDR Note API

The Note API from Cisco XDR — 8 operation(s) for note.

Cisco XDR Observe API

This set of routes allow to get in depth investigation data about a threat You might use them at the start of any investigation to get the full picture and get to know if someth...

Cisco XDR One Click API

One-click Routes

Cisco XDR Private Intel API

Access private-intel

Cisco XDR Properties API

The Properties API from Cisco XDR — 1 operation(s) for properties.

Cisco XDR Query API

This set of routes allow to query for records related to observable events.Results are returned in OCSF format.

Cisco XDR Refer API

This set of routes allow to get relevant Reference links and quickly pivot pursuing your investigation on a specific product interface.

Cisco XDR Relationship API

Relationship operations

Cisco XDR Reputation API

The Reputation API from Cisco XDR — 1 operation(s) for reputation.

Cisco XDR Response API

IROH Response

Cisco XDR Session Cookie API

Cookie-based session validation

Cisco XDR Sighting API

Sighting operations

Cisco XDR Status API

The Status API from Cisco XDR — 1 operation(s) for status.

Cisco XDR Target Record API

Target Record operations

Cisco XDR Tool API

Tool operations

Cisco XDR Verdict API

The Verdict API from Cisco XDR — 1 operation(s) for verdict.

Cisco XDR Version API

The Version API from Cisco XDR — 1 operation(s) for version.

Cisco XDR Vulnerability API

The Vulnerability API from Cisco XDR — 9 operation(s) for vulnerability.

Cisco XDR Webhook API

Webhook Routes

Cisco XDR Webhook Result API

The WebhookResult API from Cisco XDR — 2 operation(s) for webhookresult.

Cisco XDR MCP Server

Model Context Protocol server published by CiscoDevNet exposing 27 Cisco XDR tools across Inspect, Investigate, Incidents, Response Actions, Casebooks, Threat Intel, Workflows a...

Cisco XDR Calendars API

The Calendars API from Cisco XDR — 3 operation(s) for calendars.

Cisco XDR Categories API

The Categories API from Cisco XDR — 2 operation(s) for categories.

Cisco XDR Change Owner API

The ChangeOwner API from Cisco XDR — 1 operation(s) for changeowner.

Cisco XDR Comments API

The Comments API from Cisco XDR — 2 operation(s) for comments.

Cisco XDR Events API

The Events API from Cisco XDR — 2 operation(s) for events.

Cisco XDR Events Rate Limit API

The EventsRateLimit API from Cisco XDR — 1 operation(s) for eventsratelimit.

Cisco XDR Metadata API

The Metadata API from Cisco XDR — 1 operation(s) for metadata.

Cisco XDR Ratings API

The Ratings API from Cisco XDR — 3 operation(s) for ratings.

Cisco XDR References API

The References API from Cisco XDR — 1 operation(s) for references.

Cisco XDR Remote Meta API

The RemoteMeta API from Cisco XDR — 3 operation(s) for remotemeta.

Cisco XDR Rules API

The Rules API from Cisco XDR — 4 operation(s) for rules.

Cisco XDR Runtime Users API

The RuntimeUsers API from Cisco XDR — 2 operation(s) for runtimeusers.

Cisco XDR Schedules API

The Schedules API from Cisco XDR — 2 operation(s) for schedules.

Cisco XDR Schemas API

The Schemas API from Cisco XDR — 2 operation(s) for schemas.

Cisco XDR Share Object Permissions API

The ShareObjectPermissions API from Cisco XDR — 1 operation(s) for shareobjectpermissions.

Cisco XDR SXIROH Incident API

The SXIROHIncident API from Cisco XDR — 1 operation(s) for sxirohincident.

Cisco XDR Tables API

The Tables API from Cisco XDR — 2 operation(s) for tables.

Cisco XDR Table Types API

The TableTypes API from Cisco XDR — 2 operation(s) for tabletypes.

Cisco XDR Targets API

The Targets API from Cisco XDR — 3 operation(s) for targets.

Cisco XDR Tasks API

The Tasks API from Cisco XDR — 5 operation(s) for tasks.

Cisco XDR Tenants API

The Tenants API from Cisco XDR — 3 operation(s) for tenants.

Cisco XDR Triggers API

The Triggers API from Cisco XDR — 2 operation(s) for triggers.

Cisco XDR Variables API

The Variables API from Cisco XDR — 3 operation(s) for variables.

Cisco XDR Variable Types API

The VariableTypes API from Cisco XDR — 3 operation(s) for variabletypes.

Cisco XDR Webhooks API

The Webhooks API from Cisco XDR — 3 operation(s) for webhooks.

Cisco XDR Workflows API

The Workflows API from Cisco XDR — 20 operation(s) for workflows.

Cisco XDR Workflow Variable References API

The WorkflowVariableReferences API from Cisco XDR — 1 operation(s) for workflowvariablereferences.

Cisco XDR Xchange API

The Xchange API from Cisco XDR — 4 operation(s) for xchange.

Cisco XDR Incident Overview API

The Incident Overview API from Cisco XDR — 16 operation(s) for incident overview.

Cisco XDR Incident Report API

The Incident Report API from Cisco XDR — 3 operation(s) for incident report.

Cisco XDR Incident Routes using Entities API

The Incident Routes using Entities API from Cisco XDR — 5 operation(s) for incident routes using entities.

Cisco XDR Incident Summary API

The Incident Summary API from Cisco XDR — 1 operation(s) for incident summary.

Cisco XDR Investigation Creation API

The Investigation Creation API from Cisco XDR — 4 operation(s) for investigation creation.

Cisco XDR Investigation Data API

The Investigation Data API from Cisco XDR — 11 operation(s) for investigation data.

Cisco XDR Investigation Routes using Entities API

The Investigation Routes using Entities API from Cisco XDR — 3 operation(s) for investigation routes using entities.

Cisco XDR Investigation Save/Update API

The Investigation Save/Update API from Cisco XDR — 8 operation(s) for investigation save/update.

Cisco XDR Report API

The Report API from Cisco XDR — 13 operation(s) for report.

Cisco XDR Graph QL API

The Graph QL API from Cisco XDR — 1 operation(s) for graph ql.

Cisco XDR Target Groups API

The Target Groups API from Cisco XDR — 2 operation(s) for target groups.

Cisco XDR Workflow Instances API

The Workflow Instances API from Cisco XDR — 7 operation(s) for workflow instances.

Scroll for all 89

MCP Servers 1

Model Context Protocol servers that expose these APIs to AI agents.

Cisco XDR MCP Server

Local (stdio) MCP server requiring OAuth; 27 tools listed.

MCP SERVER

Agent Skills 3

Packaged agent skills for driving this provider's APIs from an AI assistant.

cisco-xdr-investigate-observable

AGENT SKILL

cisco-xdr-respond-to-threat

AGENT SKILL

cisco-xdr-triage-incident

AGENT SKILL

Cisco XDR API pricing

Prices published by Cisco XDR, read 2026-10-28 from www.cisco.com/site/us/en/products/security/xdr/index.html.

Plan	Price
Cisco XDR Essentials	Compare all plans Includes: Built-in integrations across the Cisco security portfolio
Cisco XDR Advantage	Compare all plans Includes: All features in Essentials plus curated third-party integrations
Cisco XDR Premier	Compare all plans Includes: XDR as a managed service, penetration testing, select Talos IR services

Plan details, limits and sources →

Rate limits

: 8000 rolling 60 minutes
: 8000 rolling 60 minutes
: 10 1 minute

All 5 limits →

Pricing Plans 1

Published pricing tiers and plan structures.

Cisco Xdr Plans Pricing

3 plans

PLANS

Rate Limits 1

Documented rate limits and quota policies.

Cisco Xdr Rate Limits

5 limits

RATE LIMITS

Service Levels 1

Uptime the provider promises or reports, as SLA4OAI. Read from its own pages; APIs.io runs no monitors.

Cisco XDR

SLA

FinOps 1

Cost, billing, and metering signals for API financial operations.

Cisco Xdr Finops

FINOPS

Event Specifications 1

AsyncAPI definitions for this provider's event-driven and streaming APIs.

Cisco Xdr Webhooks

ASYNCAPI

Spectral Rules 1

Spectral governance rulesets for linting and validating these APIs.

Cisco XDR API Rules

56 rules · 35 errors 15 warnings 6 info

SPECTRAL

OpenAPI Overlays 4

Overlays applied on top of this provider's contracts. Each card says who wrote it: a document the provider publishes, or one API Evangelist derived or generated.

Cisco Xdr Automation Overlay

2 actions · update · cisco-xdr-automation-openapi.json

DERIVED

Cisco Xdr Incidents Investigations Overlay

1 action · update · cisco-xdr-incidents-investigations-openapi.json

DERIVED

Cisco Xdr Inspect Overlay

2 actions · update · cisco-xdr-inspect-api-openapi.yml

DERIVED

Cisco Xdr Iroh Response Overlay

3 actions · update · cisco-xdr-response-api-openapi.yml

DERIVED

Security Posture 4

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Cisco Xdr Authentication

apiKey/oauth2 · 4 schemes

SECURITY

Cisco Xdr Domain Security

TLSv1.3 · HSTS · DMARC

SECURITY

Cisco Xdr Vulnerability Disclosure

security.txt · contact published

SECURITY

Cisco Xdr Trust Center

ISO 27001, FedRAMP, GDPR, SOC 2, BSI C5

SECURITY

Scopes 1

OAuth scopes governing access to this provider's APIs.

Cisco Xdr Scopes

41 scopes · authorizationCode/clientCredentials

41 scopes

SCOPES

Resources

Get Started 5

Portal, sign-up, and the first successful call

Portal

Portal

DeveloperPortal

GettingStarted

Login

Documentation 4

Reference material describing how the API behaves

Documentation

APIReference

OpenAPI

OpenAPI

Agent Surfaces 5

MCP servers, agent skills, and machine-readable catalogs

MCPServer

WellKnown

AgentSkill

LLMsTxt

MCPServer

Design & Contract 6

Pagination, idempotency, versioning, errors, and events

Conventions

ErrorCatalog

DataModel

Lifecycle

Conformance

Webhooks

Build 4

SDKs, sample code, and the tooling you integrate with

Packages

Packages

SDKs

SDKs

ToolCrosswalk

ToolCrosswalk

GitHubOrganization

GitHubOrganization

Access & Security 8

Authentication, authorization, and security posture

OAuthScopes

OAuthScopes

Authentication

Authentication

VulnerabilityDisclosure

VulnerabilityDisclosure

DomainSecurity

SecurityTxt

Security

TrustCenter

Compliance

Scroll for all 8

Operate 6

Status, limits, changes, and where to get help

StatusPage

ChangeLog

ChangeLog

RateLimits

Support

HelpCenter

Commercial 4

Pricing, plans, and the legal terms of use

Pricing

Plans

TermsOfService

PrivacyPolicy

Company 2

The organization behind the API

Website

Website

Blog

Blog

Other 6

Properties that don't map to a standard resource type

CapabilityMap

Overlay

Overlay

ParentCompany

Overlay

Overlay

Source (apis.yml)

aid: cisco-xdr
name: Cisco XDR
description: 'Cisco XDR is Cisco''s extended detection and response platform, the successor to SecureX. It correlates telemetry
  from Cisco Secure Endpoint, Secure Firewall, Umbrella, Duo, Secure Email and third-party sources into incidents, and exposes
  four distinct REST API families behind a single OAuth 2.0 authorization server: the IROH platform (inspect, enrich, response
  actions, integration modules, events, webhooks) at visibility.amp.cisco.com, the CTIA private-intelligence store at private.intel.amp.cisco.com,
  the Conure v2 incidents and investigations service at conure.us.security.cisco.com, and the Automation workflow engine at
  automate.us.security.cisco.com. All four publish anonymously fetchable machine-readable contracts — 52 documents, 581 operations,
  1,176 schema definitions — and Cisco additionally ships a 27-tool MCP server through CiscoDevNet, stdio-only. There is no
  sandbox, no test mode and no idempotency key anywhere, including on the operation that blocks, isolates and quarantines.'
url: https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/apis.yml
type: Index
access: 3rd-Party
deliveryModel:
  model: saas
  open_source: false
  commercial: true
  callable_host: true
  label: Hosted service · you call their endpoint
  confidence: high
  source:
  - openapi
  - pricing
  generated: '2026-08-28'
  method: derived
accessModel:
  pricing: unknown
  onboarding: unknown
  trial: false
  try_now: false
  public: false
  label: Unknown
  confidence: low
  source:
  - plans
  - authentication
  - scopes
  - rate-limits
  - security
  - sandbox
  generated: '2026-11-06'
  method: derived
position: Consuming
x-type: company
x-source: cisco-family-buildout:2026-08-19
x-parent: cisco
x-relationship: product
x-contract-status: real
x-contract-note: Anonymously fetchable Swagger 2.0 for nine IROH services at visibility.amp.cisco.com plus the CTIA threat-intelligence
  API — 581 operations. The host returns real 404s on invented paths, so the 200s are genuine.
specificationVersion: '0.23'
created: '2026-08-19'
modified: '2026-09-16'
tags:
- Security
- XDR
- Threat Detection
- Incident Response
- SOC
- Threat Intelligence
- Extended Detection and Response
- OAuth
- Webhook
- Automation
- MCP
- Authentication
tags_raw:
- Security
- XDR
- Threat Detection
- Incident Response
- SOC
- Threat Intelligence
- Extended Detection and Response
- OAuth
- Webhooks
- Automation
- MCP
- Authentication
apis:
- aid: cisco-xdr:cisco-xdr-actor-api
  name: Cisco XDR Actor API
  description: Actor operations
  tags:
  - Actor
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-actor-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-asset-api
  name: Cisco XDR Asset API
  description: Asset operations
  tags:
  - Asset
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-asset-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-asset-mapping-api
  name: Cisco XDR Asset Mapping API
  description: Asset Mapping operations
  tags:
  - Asset Mapping
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-asset-mapping-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-asset-properties-api
  name: Cisco XDR Asset Properties API
  description: Asset Properties operations
  tags:
  - Asset Properties
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-asset-properties-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-attack-pattern-api
  name: Cisco XDR Attack Pattern API
  description: Attack Pattern operations
  tags:
  - Attack Pattern
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-attack-pattern-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-bulk-api
  name: Cisco XDR Bulk API
  description: The Bulk API from Cisco XDR — 1 operation(s) for bulk.
  tags:
  - Bulk
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-bulk-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-bundle-api
  name: Cisco XDR Bundle API
  description: The Bundle API from Cisco XDR — 2 operation(s) for bundle.
  tags:
  - Bundle
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-bundle-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-campaign-api
  name: Cisco XDR Campaign API
  description: Campaign operations
  tags:
  - Campaign
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-campaign-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-casebook-api
  name: Cisco XDR Casebook API
  description: Casebook operations
  tags:
  - Casebook
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-casebook-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-coa-api
  name: Cisco XDR COA API
  description: COA operations
  tags:
  - coa
  - Security
  - XDR
  - Threat Detection
  tags_raw:
  - COA
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-coa-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-deliberate-api
  name: Cisco XDR Deliberate API
  description: This set of routes allow to quickly get answers from your integrations You might use them at the start of any
    investigation to quickly get answers from your modules if something is bad.
  tags:
  - Deliberate
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-deliberate-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/enrich-api-guide/
- aid: cisco-xdr:cisco-xdr-event-api
  name: Cisco XDR Event API
  description: Events operations
  tags:
  - Event
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-event-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-feed-api
  name: Cisco XDR Feed API
  description: Feed operations
  tags:
  - Feed
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-feed-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-feedback-api
  name: Cisco XDR Feedback API
  description: Feedback Routes
  tags:
  - Feedback
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-feedback-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-health-api
  name: Cisco XDR Health API
  description: This set of routes allow to check the health of your integrations setup Verify if your modules are setup correctly
    and if your credentials are correct.
  tags:
  - Health
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-health-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/enrich-api-guide/
- aid: cisco-xdr:cisco-xdr-incident-api
  name: Cisco XDR Incident API
  description: Incident operations
  tags:
  - Incident
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-incident-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/incident-management-api-guide/
- aid: cisco-xdr:cisco-xdr-indicator-api
  name: Cisco XDR Indicator API
  description: Indicator operations
  tags:
  - Indicator
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-indicator-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-inspect-api
  name: Cisco XDR Inspect API
  description: Inspect related routes
  tags:
  - Inspect
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-inspect-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/inspect-api-guide/
- aid: cisco-xdr:cisco-xdr-investigation-api
  name: Cisco XDR Investigation API
  description: The Investigation API from Cisco XDR — 8 operation(s) for investigation.
  tags:
  - Investigations
  - Security
  - XDR
  - Threat Detection
  tags_raw:
  - Investigation
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-investigation-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-invite-api
  name: Cisco XDR INVITE API
  description: The INVITE API from Cisco XDR — 2 operation(s) for invite.
  tags:
  - invite
  - Security
  - XDR
  - Threat Detection
  tags_raw:
  - INVITE
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-invite-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-iroh-api
  name: Cisco XDR Iroh API
  description: The Iroh API from Cisco XDR — 3 operation(s) for iroh.
  tags:
  - Iroh
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-iroh-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-judgement-api
  name: Cisco XDR Judgement API
  description: Judgement operations
  tags:
  - Judgement
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-judgement-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-login-api
  name: Cisco XDR LOGIN API
  description: The LOGIN API from Cisco XDR — 4 operation(s) for login.
  tags:
  - Login
  - Security
  - XDR
  - Threat Detection
  tags_raw:
  - LOGIN
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-login-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-malware-api
  name: Cisco XDR Malware API
  description: Malware operations
  tags:
  - Malware
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-malware-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-metrics-api
  name: Cisco XDR Metrics API
  description: The Metrics API from Cisco XDR — 1 operation(s) for metrics.
  tags:
  - Metrics
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-metrics-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-moduleinstance-api
  name: Cisco XDR Module Instance API
  description: ModuleInstance Routes
  tags:
  - ModuleInstance
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-moduleinstance-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-moduletype-api
  name: Cisco XDR Module Type API
  description: ModuleType Routes
  tags:
  - ModuleType
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-moduletype-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-moduletypepatch-api
  name: Cisco XDR Module Type Patch API
  description: ModuleTypePatch Routes
  tags:
  - ModuleTypePatch
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-moduletypepatch-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-note-api
  name: Cisco XDR Note API
  description: The Note API from Cisco XDR — 8 operation(s) for note.
  tags:
  - Note
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-note-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-observe-api
  name: Cisco XDR Observe API
  description: This set of routes allow to get in depth investigation data about a threat You might use them at the start
    of any investigation to get the full picture and get to know if something has been seen in your environment.
  tags:
  - Observe
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-observe-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/enrich-api-guide/
- aid: cisco-xdr:cisco-xdr-one-click-api
  name: Cisco XDR One Click API
  description: One-click Routes
  tags:
  - One-Click
  - Security
  - XDR
  - Threat Detection
  tags_raw:
  - One-click
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-one-click-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-private-intel-api
  name: Cisco XDR Private Intel API
  description: Access private-intel
  tags:
  - Private Intel
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-private-intel-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/incident-management-api-guide/
- aid: cisco-xdr:cisco-xdr-properties-api
  name: Cisco XDR Properties API
  description: The Properties API from Cisco XDR — 1 operation(s) for properties.
  tags:
  - Properties
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-properties-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-query-api
  name: Cisco XDR Query API
  description: This set of routes allow to query for records related to observable events.Results are returned in OCSF format.
  tags:
  - Query
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-query-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/enrich-api-guide/
- aid: cisco-xdr:cisco-xdr-refer-api
  name: Cisco XDR Refer API
  description: This set of routes allow to get relevant Reference links and quickly pivot pursuing your investigation on a
    specific product interface.
  tags:
  - Refer
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-refer-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/enrich-api-guide/
- aid: cisco-xdr:cisco-xdr-relationship-api
  name: Cisco XDR Relationship API
  description: Relationship operations
  tags:
  - Relationship
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-relationship-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-reputation-api
  name: Cisco XDR Reputation API
  description: The Reputation API from Cisco XDR — 1 operation(s) for reputation.
  tags:
  - Reputation
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-reputation-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/enrich-api-guide/
- aid: cisco-xdr:cisco-xdr-response-api
  name: Cisco XDR Response API
  description: IROH Response
  tags:
  - Response
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-response-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/response-api-guide/
- aid: cisco-xdr:cisco-xdr-session-cookie-api
  name: Cisco XDR Session Cookie API
  description: Cookie-based session validation
  tags:
  - Session Cookie
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-session-cookie-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-sighting-api
  name: Cisco XDR Sighting API
  description: Sighting operations
  tags:
  - Sighting
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-sighting-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-status-api
  name: Cisco XDR Status API
  description: The Status API from Cisco XDR — 1 operation(s) for status.
  tags:
  - Status
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-status-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-target-record-api
  name: Cisco XDR Target Record API
  description: Target Record operations
  tags:
  - Target Record
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-target-record-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-tool-api
  name: Cisco XDR Tool API
  description: Tool operations
  tags:
  - Tool
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-tool-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-verdict-api
  name: Cisco XDR Verdict API
  description: The Verdict API from Cisco XDR — 1 operation(s) for verdict.
  tags:
  - Verdict
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-verdict-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-version-api
  name: Cisco XDR Version API
  description: The Version API from Cisco XDR — 1 operation(s) for version.
  tags:
  - Version
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-version-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-vulnerability-api
  name: Cisco XDR Vulnerability API
  description: The Vulnerability API from Cisco XDR — 9 operation(s) for vulnerability.
  tags:
  - Vulnerabilities
  - Security
  - XDR
  - Threat Detection
  tags_raw:
  - Vulnerability
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-vulnerability-api-openapi.yml
  baseURL: https://private.intel.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-webhook-api
  name: Cisco XDR Webhook API
  description: Webhook Routes
  tags:
  - Webhook
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-webhook-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-webhookresult-api
  name: Cisco XDR Webhook Result API
  description: The WebhookResult API from Cisco XDR — 2 operation(s) for webhookresult.
  tags:
  - WebhookResult
  - Security
  - XDR
  - Threat Detection
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-webhookresult-api-openapi.yml
  baseURL: https://visibility.amp.cisco.com
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
- aid: cisco-xdr:cisco-xdr-mcp-server
  name: Cisco XDR MCP Server
  description: Model Context Protocol server published by CiscoDevNet exposing 27 Cisco XDR tools across Inspect, Investigate,
    Incidents, Response Actions, Casebooks, Threat Intel, Workflows and Admin, plus 5 resources and 6 prompts. Apache-2.0,
    TypeScript, stdio transport only — there is no hosted endpoint and the package is not on npm, so a human must clone and
    build it before any agent can reach Cisco XDR through it.
  humanURL: https://github.com/CiscoDevNet/xdr-mcp-community
  baseURL: https://visibility.amp.cisco.com
  tags:
  - Security
  - XDR
  - MCP
  - Agents
  - Threat Detection
  tags_raw:
  - Security
  - XDR
  - MCP
  - Agent
  - Threat Detection
  properties:
  - type: MCPServer
    url: mcp/cisco-xdr-mcp.yml
  - type: MCPServer
    url: https://github.com/CiscoDevNet/xdr-mcp-community
  - type: ToolCrosswalk
    url: mcp/cisco-xdr-tool-crosswalk.yml
  - type: AgentSkill
    url: skills/_index.yml
  - type: Documentation
    url: https://github.com/CiscoDevNet/xdr-mcp-community/blob/main/INSTALL.md
- aid: cisco-xdr:cisco-xdr-calendars-api
  name: Cisco XDR Calendars API
  description: The Calendars API from Cisco XDR — 3 operation(s) for calendars.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Calendar
  tags_raw:
  - Calendars
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-calendars-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-categories-api
  name: Cisco XDR Categories API
  description: The Categories API from Cisco XDR — 2 operation(s) for categories.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Categories
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-categories-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-changeowner-api
  name: Cisco XDR Change Owner API
  description: The ChangeOwner API from Cisco XDR — 1 operation(s) for changeowner.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - ChangeOwner
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-changeowner-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-comments-api
  name: Cisco XDR Comments API
  description: The Comments API from Cisco XDR — 2 operation(s) for comments.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Comments
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-comments-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-events-api
  name: Cisco XDR Events API
  description: The Events API from Cisco XDR — 2 operation(s) for events.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Event
  tags_raw:
  - Events
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-events-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-eventsratelimit-api
  name: Cisco XDR Events Rate Limit API
  description: The EventsRateLimit API from Cisco XDR — 1 operation(s) for eventsratelimit.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - EventsRateLimit
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-eventsratelimit-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-metadata-api
  name: Cisco XDR Metadata API
  description: The Metadata API from Cisco XDR — 1 operation(s) for metadata.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Metadata
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-metadata-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-ratings-api
  name: Cisco XDR Ratings API
  description: The Ratings API from Cisco XDR — 3 operation(s) for ratings.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Ratings
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-ratings-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-references-api
  name: Cisco XDR References API
  description: The References API from Cisco XDR — 1 operation(s) for references.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - References
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-references-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-remotemeta-api
  name: Cisco XDR Remote Meta API
  description: The RemoteMeta API from Cisco XDR — 3 operation(s) for remotemeta.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - RemoteMeta
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-remotemeta-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-rules-api
  name: Cisco XDR Rules API
  description: The Rules API from Cisco XDR — 4 operation(s) for rules.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Rules
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-rules-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-runtimeusers-api
  name: Cisco XDR Runtime Users API
  description: The RuntimeUsers API from Cisco XDR — 2 operation(s) for runtimeusers.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - RuntimeUsers
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-runtimeusers-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-schedules-api
  name: Cisco XDR Schedules API
  description: The Schedules API from Cisco XDR — 2 operation(s) for schedules.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Schedule
  tags_raw:
  - Schedules
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-schedules-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-schemas-api
  name: Cisco XDR Schemas API
  description: The Schemas API from Cisco XDR — 2 operation(s) for schemas.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Schema
  tags_raw:
  - Schemas
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-schemas-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-shareobjectpermissions-api
  name: Cisco XDR Share Object Permissions API
  description: The ShareObjectPermissions API from Cisco XDR — 1 operation(s) for shareobjectpermissions.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - ShareObjectPermissions
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-shareobjectpermissions-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-sxirohincident-api
  name: Cisco XDR SXIROH Incident API
  description: The SXIROHIncident API from Cisco XDR — 1 operation(s) for sxirohincident.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - SXIROHIncident
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-sxirohincident-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-tables-api
  name: Cisco XDR Tables API
  description: The Tables API from Cisco XDR — 2 operation(s) for tables.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Tables
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-tables-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-tabletypes-api
  name: Cisco XDR Table Types API
  description: The TableTypes API from Cisco XDR — 2 operation(s) for tabletypes.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - TableTypes
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-tabletypes-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-targets-api
  name: Cisco XDR Targets API
  description: The Targets API from Cisco XDR — 3 operation(s) for targets.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Targets
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-targets-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-tasks-api
  name: Cisco XDR Tasks API
  description: The Tasks API from Cisco XDR — 5 operation(s) for tasks.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Task
  tags_raw:
  - Tasks
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-tasks-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-tenants-api
  name: Cisco XDR Tenants API
  description: The Tenants API from Cisco XDR — 3 operation(s) for tenants.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Tenants
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-tenants-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-triggers-api
  name: Cisco XDR Triggers API
  description: The Triggers API from Cisco XDR — 2 operation(s) for triggers.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Triggers
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-triggers-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-variables-api
  name: Cisco XDR Variables API
  description: The Variables API from Cisco XDR — 3 operation(s) for variables.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Variables
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-variables-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-variabletypes-api
  name: Cisco XDR Variable Types API
  description: The VariableTypes API from Cisco XDR — 3 operation(s) for variabletypes.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - VariableTypes
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-variabletypes-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-webhooks-api
  name: Cisco XDR Webhooks API
  description: The Webhooks API from Cisco XDR — 3 operation(s) for webhooks.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Webhook
  tags_raw:
  - Webhooks
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-webhooks-api-openapi.yml
- aid: cisco-xdr:cisco-xdr-workflows-api
  name: Cisco XDR Workflows API
  description: The Workflows API from Cisco XDR — 20 operation(s) for workflows.
  humanURL: https://developer.cisco.com/docs/cisco-xdr/
  baseURL: https://private.intel.amp.cisco.com
  tags:
  - Workflows
  properties:
  - type: OpenAPI
    url: openapi/cisco-xdr-workflows-api-openapi.yml


# --- truncated at 32 KB (41 KB total) ---
# Full source: https://artifacts.apis.io/cisco-xdr/apis.yml

Cisco XDR API — frequently asked questions

Does Cisco XDR have an API?

Yes. APIs.io lists 89 APIs from Cisco XDR, including Cisco XDR Actor API, Cisco XDR Asset API and Cisco XDR Asset Mapping API, and 86 more.

Is there an OpenAPI specification for the Cisco XDR API?

Yes. APIs.io indexes 88 OpenAPI specifications for Cisco XDR, each linked for download from this page.

How do I authenticate with the Cisco XDR API?

Cisco XDR uses bearer-token authentication (apiKey/oauth2 · 4 schemes). The details are profiled on APIs.io as Cisco Xdr Authentication.

How much does the Cisco XDR API cost?

Cisco XDR publishes its prices; its Cisco XDR Essentials plan is Compare all plans as of 2026-10-28. APIs.io lists 3 pricing plans for Cisco XDR, with each plan's price, limits and inclusions under Pricing on this page.

Does Cisco XDR have an MCP server?

Yes. APIs.io lists 1 MCP server for Cisco XDR: Local (stdio) MCP server requiring OAuth; 27 tools listed.

Is the Cisco XDR API ready for AI agents?

Cisco XDR has a Kin Score of 69.9 out of 100 (exemplar) and an Agent Readiness score of 39.1 (agent-ready), scored by API Evangelist on 2026-11-06.

Work with this as data

Every provider here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for providers

9 MCP tools reach this

find_providersBrowse and filter every provider in the catalog.
get_provider_artifactsEvery artifact this provider publishes, grouped by type.
get_provider_operationsEvery operation across all of their OpenAPIs — one call instead of parsing every spec.
get_provider_toolsEvery MCP tool they ship, with the operation each wraps.
get_provider_evidenceHow each part of their score was established. Free — the basis for a claim should not sit behind it.
get_provider_ratingPRO — composite, band, trend and facet scores.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This provider

curl "https://apis.io/api/v1/providers/cisco-xdr"

All providers

curl "https://apis.io/api/v1/providers?limit=25"

Every operation they expose

curl "https://apis.io/api/v1/providers/cisco-xdr/operations?limit=25"

How their score was established

curl "https://apis.io/api/v1/providers/cisco-xdr/evidence"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.