Skip to main content
Initiate a new endpoint script execution action using provided snippet code.
External DocumentationTo learn more, visit the Cortex XDR documentation.

​
Parameters

ParameterDescription
CodeThe script to be run on the endpoint.
EndpointThe endpoint in which the script will be run. Select the endpoint’s hostname or manually type its ID.
Incident IDString representing the incident ID.

When included in the request, the Isolate Endpoints action will appear in the Cortex XDR Incident View Timeline tab.
TimeoutThe timeout in seconds for this execution.

​
Example Output

{
	"reply": {
		"action_id": "<action ID>",
		"endpoints_count": 21
	}
}

​
Workflow Library Example

Execute Python Script with Cortex Xdr and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop
⌘I