Cortex Cloud - Find duplicate connectors using public api and linux commands - specifically for non AZURE connectors

Sometimes, we find multiple duplicate connectors configured for the same accounts. This configuration is currently not supported and may result in increased system load or scan failures.

In this case, the newly added connector assets may remain in a pending state because their scan tasks are being delayed by a large number of other scan tasks in the queue.

Below is a suggested way to help you find duplicate connectors using public api and linux commands - specifically for non AZURE connectors

duplicate connectors configured for the same accounts. This configuration is currently not supported and may result in increased system load or scan failures.

In this case, the newly added connector assets may remain in a pending state because their scan tasks are being delayed by a large number of other scan tasks in the queue.

**Product_versions**
Product: Cortex XDR, Cortex Cloud

**Topology/Configuration**
Non-Azure environment

First set up access to public API - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Create-a-new-API-key

Use onboarding APIs to get all the connectors information for your tenant.

API link - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Get-all-or-filtered-cloud-instances

We suggest to combine with jq command to find connectors with the same account, for example:

curl -X POST https://api-{fqdn}/public_api/v1/cloud_onboarding/get_instances \
-H "x-xdr-auth-id:{key_id}" \
-H "Authorization:{key}" \
-H "Content-Type:application/json" \
-d '{
"request_data": {
"filter_data": {
"sort": [
{
"FIELD": "STATUS",
"ORDER": "DESC"
}
],
"paging": {
"from": 0,
"to": 300
},
"filter": {
"AND": [
{
"SEARCH_FIELD": "STATUS",
"SEARCH_TYPE": "NEQ",
"SEARCH_VALUE": "PENDING"
}
]
}
}
}
}' | jq '.reply.DATA | map(select(.account_name != "")) | group_by(.account_name) | map(select(length > 1))'

If you see many disabled connectors in the output you can add NEQ DISABLED to the filtering object