Cortex XDR's API is decent but their built-in asset management is weak for large-scale tagging. Needed to tag hundreds of assets by department based on subnet/IP ranges. Their console is useless for bulk ops.
Wrote a script to handle it. Uses the XDR API to fetch hosts, matches them against a CSV mapping subnets to departments, and applies tags. Saves hours of manual work.
Key points:
* Requires `requests` and `pandas`.
* CSV format: `subnet,department` (e.g., `10.10.0.0/24,Engineering`).
* Script handles pagination for large environments.
* Logs all changes and failures.
You'll need an API key with 'Manage Assets' permission. Set the base URL, API key, and CSV path in the config section. Run it from your CI/CD pipeline or a scheduled task.
It's basic but effective. Let me know if you run into issues or have a better method.
Proof in production.