Skip to content

v2.0.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Dec 09:16
· 2 commits to main since this release
v2.0.4
effb9b1
XDRTop Logo

XDRTop v2.0.4

Terminal-based monitoring tool for Cortex XSIAM/CLOUD and XDR from GoCortex.io

A Rust CLI application providing real-time, interactive case tracking with an htop-style interface. XDRTop connects to the Cortex Platform Cases API to display security cases with filtering, drill-down issue details, and MITRE ATT&CK framework integration.

Whats New

KNOWN ISSUES:

  • Having an issue with drilldown at the moment, ideally this wouldn't go out but I need to draw a line somewhere

NEW FEATURES:

  • Migrated from legacy Incidents API to Cases API (/public_api/v1/case/search)
  • Issue Search API integration for case drill-down (/public_api/v1/issue/search)
  • Domain column and filtering with 'd' keyboard shortcut
  • Incremental sync using modification_time cursors
  • New fields: hosts, users, xdr_url, tags, severity breakdown counts

FIXES:

  • Security updates (122 packages)

ROADMAP:

  • GitHub Actions build process with tag-triggered releases
  • MUSL static linking for portable binaries
  • Quick lookback option for faster initial load

Features

  • Interactive terminal interface with real-time updates
  • Complete case coverage via paginated API fetching
  • Two-minute smart caching to reduce API load
  • Severity and status filtering with keyboard shortcuts
  • Case drill-down showing issue details and MITRE ATT&CK data
  • Domain-based filtering (Security, Posture)
  • Cross-platform support (Linux, macOS, Windows)

High-performance Rust CLI monitoring tool for Cortex XDR with real-time case tracking.

Downloads

  • Linux (Debian/Ubuntu): Download the .deb package
  • macOS (Intel): Download xdrtop-macos-x86_64.tar.gz
  • macOS (Apple Silicon): Download xdrtop-macos-aarch64.tar.gz
  • Windows: Download xdrtop-windows-x86_64.zip

Installation

Debian/Ubuntu

sudo dpkg -i xdrtop-linux-x86_64.deb

macOS

tar -xzf xdrtop-macos-*.tar.gz
sudo mv xdrtop-macos-* /usr/local/bin/xdrtop

Windows

# Extract ZIP and add to PATH
Expand-Archive xdrtop-windows-x86_64.zip -DestinationPath C:\Tools\xdrtop
# Add C:\Tools\xdrtop to your PATH environment variable

Configuration

Create your configuration file at ~/.xdrtop/config.json:

{
  "api_key_id": "your-api-key-id",
  "api_key_secret": "your-api-key-secret",
  "tenant_url": "https://api-your-tenant.xdr.au.paloaltonetworks.com"
}

Full Changelog: v1.0.35...v2.0.4

Assets 6
Loading