--- title: Sophos Central slug: connectors/sophos-central docTags: createdAt: 2026-06-09T16:29:59.202Z --- The Sophos Central connector enables streamlined security management and automation by interfacing with Sophos' suite of security products. Sophos Central is a unified console for managing Sophos products, offering a comprehensive security solution. The Sophos Central Turbine Connector allows users to automate critical security tasks such as managing allowlists and blocklists, executing alert actions, and isolating endpoints. By integrating with Sophos Central, Swimlane Turbine users can streamline threat response, enhance endpoint security, and leverage Sophos' advanced threat intelligence within their automated workflows. Sophos Central's Public API program makes it easy for you to automate your monitoring, security and administration activities in Sophos Central. This Connector integrates Sophos Central's REST API with Swimlane Turbine to analyze URLs, IPs, and files for threats. ## Prerequisites To effectively utilize the Sophos Central connector with Swimlane Turbine, ensure you have the following prerequisites: - OAuth 2.0 client credentials authentication with the following parameters: - URL: The base URL for the Sophos Central API. - Client ID: Your Sophos Central application client identifier. - Client Secret: The secret key associated with your Sophos Central application. ## Asset Setup - To obtain the required asset paramaters - url, client\_id, client\_secret. - [click here](https://developer.sophos.com/getting-started-tenant) ## Capabilities This Connector currently supports the following capabilities: - Common API - Execute Alert Action - List Alert Actions - Endpoint API - Add Entities To Allowlist - Add Entities To Blocklist - Get Isolation by Endpoint - Get Endpoints - Isolate or Unisolate Endpoints - Scan Endpoints - SIEM Integration API - Get SIEM Alerts - Get SIEM Events ## Task Setup - The following tasks inputs there are different ways to pass parameters - Get Endpoints - for **lastSeenBefore** and **lastSeenAfter** parameters you can pass two values - date and time (UTC) ex: 2019-09-23T12:02:01.700Z - duration relative to the current date and time ex: -PT1D4H500S (PTnDnHnS) and negative indicates time ago. ## Notes Authentication steps to get **X-Tenant-ID**, **URL**. - [Authentication information can be found here](https://developer.sophos.com/intro#introduction) - [API Documentation for Common API](https://developer.sophos.com/docs/common-v1/1/overview) - [API Documentaion for Endpoint API](https://developer.sophos.com/docs/endpoint-v1/1/overview) - [API Documentation for SIEM Integration API](https://developer.sophos.com/docs/siem-v1/1/overview) # Configurations ## Sophos Central Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | --------------- | ---------------------------------------------------------- | -------- | ------------ | | url | A URL to the target DataRegion. | string | Required | | X-Tenant-ID | X Tenant ID. | string | Optional | | token\_url | | string | Optional | | X-Tenant-ID-url | A URL to get the X-Tenant-ID, if X-Tenant-ID not provided. | string | Optional | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | scope | Permission scopes for this action. | array | Optional | | verify\_ssl | Verify SSL certificate. | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Entities To Allowlist Exempt items from conviction by adding them to the Sophos Central allowlist with specified type, properties, and an optional comment. ### Endpoint - **URL:** `/endpoint/v1/settings/allowed-items` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------- | | `type` | string | Optional | Property by which an item is allowed. | | `properties` | object | Optional | Allowed item properties. | | `properties.fileName` | string | Optional | File name. | | `properties.path` | string | Optional | Path for the application. | | `properties.sha256` | string | Optional | Sha256 value for the application. | | `properties.certificateSigner` | string | Optional | Value saved for the certificateSigner. | | `comment` | string | Optional | Comment indicating why the item should be allowed. | | `originPersonId` | string | Optional | Person associated with the endpoint where the item to be allowed was last seen. | | `originEndpointId` | string | Optional | Endpoint where the item to be allowed was last seen. | ### Input Example `{"json_body":{"type":"path","properties":{"fileName":"filename.txt","path":"$desktop/documents/filename.txt","sha256":"","certificateSigner":""},"comment":"Item is not a Malware","originPersonId":"3fa85f64-5717-4562-b3fc-2c963f66afa6","originEndpointId":"3fa85f64-5717-4562-b3fc-2c963f66afa6"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `createdAt` | string | Output field: createdAt | | `updatedAt` | string | Output field: updatedAt | | `properties` | object | Output field: properties | | `properties.fileName` | string | Name of the resource | | `properties.path` | string | Output field: properties.path | | `properties.sha256` | string | Output field: properties.sha256 | | `properties.certificateSigner` | string | Output field: properties.certificateSigner | | `comment` | string | Output field: comment | | `type` | string | Type of the resource | | `createdBy` | object | Output field: createdBy | | `createdBy.id` | string | Unique identifier | | `createdBy.name` | string | Name of the resource | | `originPerson` | object | Output field: originPerson | | `originPerson.id` | string | Unique identifier | | `originPerson.name` | string | Name of the resource | | `originEndpoint` | object | Output field: originEndpoint | | `originEndpoint.id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"123e4567-e89b-12d3-a456-426614174000","createdAt":"2024-06-24T15:00:00Z","updatedAt":"2024-06-24T15:30:00Z","properties":{"fileName":"example.exe","path":"/opt/application/example.exe","sha256":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","certificateSigner":"Example Signer"},"comment":"Allowed for testing purposes.","type":"sha256","createdBy":{"id":"111aaa222bbb333ccc444ddd555eee666","name":"Admin U...` ## Add Entities To Blocklist Blocks an entity in Sophos Central by specifying type, properties, and a comment. Requires 'type', 'properties', and 'comment' in JSON body input. ### Endpoint - **URL:** `/endpoint/v1/settings/blocked-items` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | -------------------------------------------------- | | `type` | string | Optional | Property by which an item is blocked. | | `properties` | object | Optional | Blocked item properties. | | `properties.fileName` | string | Optional | File name. | | `properties.path` | string | Optional | Path for the application. | | `properties.sha256` | string | Optional | Sha256 value for the application. | | `properties.certificateSigner` | string | Optional | Value saved for the certificateSigner. | | `comment` | string | Optional | Comment indicating why the item should be blocked. | ### Input Example `{"json_body":{"type":"sha256","properties":{"fileName":"filename.txt","path":"$desktop/documents/filename.txt","sha256":"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad","certificateSigner":"xyz"},"comment":"Item is a Malware"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `createdAt` | string | Output field: createdAt | | `updatedAt` | string | Output field: updatedAt | | `properties` | object | Output field: properties | | `properties.fileName` | string | Name of the resource | | `properties.path` | string | Output field: properties.path | | `properties.sha256` | string | Output field: properties.sha256 | | `properties.certificateSigner` | string | Output field: properties.certificateSigner | | `comment` | string | Output field: comment | | `type` | string | Type of the resource | | `createdBy` | object | Output field: createdBy | | `createdBy.id` | string | Unique identifier | | `createdBy.name` | string | Name of the resource | | `originPerson` | object | Output field: originPerson | | `originPerson.id` | string | Unique identifier | | `originPerson.name` | string | Name of the resource | | `originEndpoint` | object | Output field: originEndpoint | | `originEndpoint.id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"456e7890-f321-4dc5-ba87-654edcba0987","createdAt":"2024-06-25T10:00:00Z","updatedAt":"2024-06-25T10:15:00Z","properties":{"fileName":"malicious.exe","path":"/tmp/malicious.exe","sha256":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789","certificateSigner":"Unknown"},"comment":"Detected as malicious by antivirus engine.","type":"sha256","createdBy":{"id":"111aaa222bbb333ccc444ddd555eee666","name":"Security ...` ## Execute Alert Action Executes a specified action on an identified alert in Sophos Central using the alertId and action details provided. ### Endpoint - **URL:** `/common/v1/alerts/{{alertId}}/actions` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.alertId` | string | Required | Alert ID. | | `action` | string | Optional | Actions that you can perform on these alerts. | | `message` | string | Optional | Message to send for the action. | ### Input Example `{"json_body":{"action":"cleanPua","message":"Remove WinExeSvc"},"path_parameters":{"alertId":"a5ded91c-6575-435c-a6b4-64b94f9048ff"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `alertId` | string | Unique identifier | | `action` | string | Output field: action | | `status` | string | Status value | | `requestedAt` | string | Output field: requestedAt | | `startedAt` | string | Output field: startedAt | | `completedAt` | string | Output field: completedAt | | `result` | string | Result of the operation | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"2f2d0c43-5687-4cf6-ba15-dd1c1173e673","alertId":"f9415c5f-e0e9-41d7-8126-1956223a66f1","action":"cleanPua","status":"started","requestedAt":"2021-02-12T14:35:20.248","startedAt":"2021-02-12T14:37:01.922","completedAt":"2021-02-12T14:37:01.922","result":"xyz"}}` ## Get Endpoints Retrieves a comprehensive list of all endpoints associated with the specified tenant in Sophos Central. ### Endpoint - **URL:** `/endpoint/v1/endpoints` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.pageFromKey` | string | Optional | The key of the item from where to fetch a page. | | `parameters.pageSize` | number | Optional | The size of the page requested. | | `parameters.pageTotal` | boolean | Optional | Whether the number of pages should be calculated and returned in the response. | | `parameters.sort` | array | Optional | Defines how to sort the data. | | `parameters.healthStatus` | array | Optional | Find endpoints by health status. | | `parameters.type` | array | Optional | Find endpoints by type. | | `parameters.tamperProtectionEnabled` | boolean | Optional | Find endpoints by whether Tamper Protection is turned on. | | `parameters.lockdownStatus` | array | Optional | Find endpoints by lockdown status. | | `parameters.lastSeenBefore` | string | Optional | Find endpoints that were last seen before the given date and time (UTC) or a duration relative to the current date and time (exclusive), or you can provide 3 days 4 hours 5 minutes and 0 seconds ago, value is case-sensitive(-P3DT4H5M0S). | | `parameters.lastSeenAfter` | string | Optional | Find endpoints that were last seen after the given date and time (UTC) or a duration relative to the current date and time (inclusive), or you can provide 3 days 4 hours 5 minutes and 0 seconds ago, value is case-sensitive(-P3DT4H5M0S). | | `parameters.ids` | array | Optional | Find endpoints with the specified IDs. | | `parameters.isolationStatus` | string | Optional | Find endpoints by isolation status. | | `parameters.hostnameContains` | string | Optional | Find endpoints where the hostname contains the given string. Only the first 10 characters of the given string are matched. | | `parameters.associatedPersonContains` | string | Optional | Find endpoints where the name of the person associated with the endpoint contains the given string. | | `parameters.groupNameContains` | string | Optional | Find endpoints where the name of the group the endpoint is in contains the given string. | | `parameters.search` | string | Optional | Term to search for in the specified search fields. | | `parameters.searchFields` | array | Optional | List of search fields for finding the given search term. Defaults to all applicable fields. By default it takes all five values in an array. | | `parameters.ipAddresses` | array | Optional | Find endpoints by IP addresses. | | `parameters.cloud` | array | Optional | Find endpoints that are cloud instances. | | `parameters.fields` | array | Optional | The fields to return in a partial response. | | `parameters.view` | string | Optional | Type of view to be returned in response. | | `parameters.assignedToGroup` | boolean | Optional | Whether endpoint is assigned to a group. | | `parameters.groupIds` | array | Optional | Match endpoints by assigned group. | | `parameters.macAddresses` | array | Optional | Find endpoints by MAC Addresses. Must contain at most 50 items must be unique. | ### Input Example `{"parameters":{"pageFromKey":"abcdef123456","pageSize":50,"pageTotal":false,"sort":["hostname:asc","lastSeenAt:desc"],"healthStatus":["good","bad"],"type":["computer","server"],"tamperProtectionEnabled":true,"lockdownStatus":["unlocked","notInstalled"],"lastSeenBefore":"2019-09-23T12:02:01.700Z","lastSeenAfter":"PT4H500S","ids":["123e4567-e89b-12d3-a456-426614174000","987e6543-21cb-43d1-ba69-123456789000"],"isolationStatus":"isolated","hostnameContains":"example","associatedPersonContains":"john","groupNameContains":"workstations","search":"windows","searchFields":["hostname","groupName","associatedPersonName","osName"],"ipAddresses":["192.168.1.100","10.0.0.1"],"cloud":["aws:i-3bc4829309","azure:42349c92"],"fields":["id","hostname","os"],"view":"full","assignedToGroup":true,"groupIds":["654321ab-cdef-9876-5432-fedcba098765","abcdef12-3456-7890-fedc-ba9876543210"],"macAddresses":["01:23:45:67:89:AB","0123456789ab"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.id` | string | Unique identifier | | `items.type` | string | Type of the resource | | `items.tenant` | object | Output field: items.tenant | | `items.tenant.id` | string | Unique identifier | | `items.tenant.hostname` | string | Name of the resource | | `items.health` | object | Output field: items.health | | `items.health.overall` | string | Output field: items.health.overall | | `items.threats` | object | Output field: items.threats | | `items.threats.status` | string | Status value | | `items.services` | object | Output field: items.services | | `items.services.status` | string | Status value | | `items.services.serviceDetails` | array | Output field: items.services.serviceDetails | | `items.services.serviceDetails.name` | string | Name of the resource | | `items.services.serviceDetails.status` | string | Status value | | `items.os` | object | Output field: items.os | | `items.os.isServer` | boolean | Output field: items.os.isServer | | `items.os.platform` | string | Output field: items.os.platform | | `items.os.name` | string | Name of the resource | | `items.os.majorVersion` | number | Output field: items.os.majorVersion | | `items.os.minorVersion` | number | Output field: items.os.minorVersion | | `items.os.build` | number | Output field: items.os.build | | `items.os.ipv4Addresses` | array | Output field: items.os.ipv4Addresses | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"pages":{"fromKey":"key1","nextKey":"key2","size":10,"total":100,"items":1000,"maxSize":50}}}` ## Get Isolation by Endpoint Retrieve isolation settings for a specified endpoint in Sophos Central using the unique endpointId. ### Endpoint - **URL:** `/endpoint/v1/endpoints/{{endpointId}}/isolation` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------- | | `path_parameters.endpointId` | string | Required | Endpoint ID. | ### Input Example `{"path_parameters":{"endpointId":"416e722a-4ee3-4e81-98c0-a5489ee23fc6"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `enabled` | boolean | Output field: enabled | | `lastEnabledAt` | string | Output field: lastEnabledAt | | `lastEnabledBy` | object | Output field: lastEnabledBy | | `lastEnabledBy.id` | string | Unique identifier | | `lastEnabledBy.type` | string | Type of the resource | | `lastEnabledBy.name` | string | Name of the resource | | `lastEnabledBy.accountType` | string | Type of the resource | | `lastEnabledBy.accountId` | string | Unique identifier | | `lastDisabledAt` | string | Output field: lastDisabledAt | | `lastDisabledBy` | object | Output field: lastDisabledBy | | `lastDisabledBy.id` | string | Unique identifier | | `lastDisabledBy.type` | string | Type of the resource | | `lastDisabledBy.name` | string | Name of the resource | | `lastDisabledBy.accountType` | string | Type of the resource | | `lastDisabledBy.accountId` | string | Unique identifier | | `comment` | string | Output field: comment | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 25 Jun 2024 08:37:17 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Correlation-ID":"ff459065-adfe-4deb-8d75-8df4d1629e7f","X-Request-ID":"49f7d5e4-c3b0-4314-a965-a3338b232b09"},"reason":"","json_body":{"enabled":true,"lastEnabledAt":"2024-06-25T15:30:00Z","lastEnabledBy":{"id":"john.doe@example.com","type":"user","name":"John Doe","accountType":"organization","accountId":"98765432-abcdef-01234...` ## Get SIEM Alerts Fetches the latest Sophos Central SIEM alerts, including timestamps, from the past 24 hours. ### Endpoint - **URL:** `/siem/v1/alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.limit` | number | Optional | The maximum number of items to return. | | `parameters.from_date` | number | Optional | The starting date from which alerts will be retrieved defined as Unix timestamp in UTC. Ignored if cursor is set. Must be within last 24 hours. | | `parameters.cursor` | string | Optional | Identifier for next item in the list, this value is available in response as next\_cursor. | ### Input Example `{"parameters":{"limit":100,"from_date":86400,"cursor":"xyz"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `has_more` | boolean | Output field: has\_more | | `items` | array | Output field: items | | `items.created_at` | string | Output field: items.created\_at | | `items.customer_id` | string | Unique identifier | | `items.data` | object | Response data | | `items.description` | string | Output field: items.description | | `items.event_service_event_id` | string | Unique identifier | | `items.id` | string | Unique identifier | | `items.info` | object | Output field: items.info | | `items.location` | string | Output field: items.location | | `items.severity` | string | Output field: items.severity | | `items.source` | string | Output field: items.source | | `items.threat` | string | Output field: items.threat | | `items.threat_cleanable` | boolean | Output field: items.threat\_cleanable | | `items.type` | string | Type of the resource | | `items.when` | string | Output field: items.when | | `next_cursor` | string | Output field: next\_cursor | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"has_more":false,"items":[{}],"next_cursor":"abcdef123456"}}` ## Get SIEM Events Retrieve Sophos Central events with timestamps from the last 24 hours for SIEM integration. ### Endpoint - **URL:** `/siem/v1/events` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------- | | `prameters` | object | Optional | Parameter for Get SIEM Events | | `prameters.limit` | number | Optional | The maximum number of items to return. | | `prameters.cursor` | string | Optional | Identifier for next item in the list, this value is available in response as next\_cursor. | | `prameters.from_date` | number | Optional | The starting date from which alerts will be retrieved defined as Unix timestamp in UTC.Ignored if cursor is set. | | `prameters.exclude_types` | string | Optional | The String of list of types of events to be excluded. | ### Input Example `{"prameters":{"limit":100,"cursor":"xyz","from_date":"86400","exclude_types":"error,warning,info,debug"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `has_more` | boolean | Output field: has\_more | | `items` | array | Output field: items | | `items.amsi_threat_data` | object | Response data | | `items.amsi_threat_data.parentProcessId` | string | Response data | | `items.amsi_threat_data.parentProcessPath` | string | Response data | | `items.amsi_threat_data.processId` | string | Response data | | `items.amsi_threat_data.processName` | string | Response data | | `items.amsi_threat_data.processPath` | string | Response data | | `items.appCerts` | array | Output field: items.appCerts | | `items.appCerts.signer` | string | Output field: items.appCerts.signer | | `items.appCerts.thumbprint` | string | Output field: items.appCerts.thumbprint | | `items.appSha256` | string | Output field: items.appSha256 | | `items.core_remedy_items` | object | Output field: items.core\_remedy\_items | | `items.core_remedy_items.items` | array | Output field: items.core\_remedy\_items.items | | `items.core_remedy_items.items.descriptor` | string | Output field: items.core\_remedy\_items.items.descriptor | | `items.core_remedy_items.items.result` | string | Result of the operation | | `items.core_remedy_items.items.type` | string | Type of the resource | | `items.core_remedy_items.totalItems` | number | Output field: items.core\_remedy\_items.totalItems | | `items.created_at` | string | Output field: items.created\_at | | `items.customer_id` | string | Unique identifier | | `items.details` | array | Output field: items.details | | `items.details.property` | string | Output field: items.details.property | | `items.details.type` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"has_more":true,"items":[{}],"next_cursor":"next_cursor_example"}}` ## Isolate or Unisolate Endpoints Enables or disables isolation for multiple endpoints in Sophos Central, with a recommended time gap between state changes. ### Endpoint - **URL:** `/endpoint/v1/endpoints/isolation` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------------------------- | | `enabled` | boolean | Optional | Whether the endpoints should be isolated or not. | | `comment` | string | Optional | Reason the endpoints should be isolated or not. Length is lessthan 400. | | `ids` | array | Optional | List of endpoints IDs. Max contain is 50. | ### Input Example `{"json_body":{"enabled":true,"comment":"Isolating endpoints with suspicious health","ids":["3fa85f64-5717-4562-b3fc-2c963f66afa6","9d5d6819-0238-43e6-ba03-815cae0d474d","2da8b591-9164-4f7e-a367-ad9b9cb77736","66046f6a-bff0-4b51-aa0b-ac18bd363207"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | -------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `isolation` | object | Output field: isolation | | `isolation.enabled` | boolean | Output field: isolation.enabled | | `isolation.lastEnabledAt` | string | Output field: isolation.lastEnabledAt | | `isolation.lastEnabledBy` | object | Output field: isolation.lastEnabledBy | | `isolation.lastEnabledBy.id` | string | Unique identifier | | `isolation.lastEnabledBy.type` | string | Type of the resource | | `isolation.lastEnabledBy.name` | string | Name of the resource | | `isolation.lastEnabledBy.accountType` | string | Type of the resource | | `isolation.lastEnabledBy.accountId` | string | Unique identifier | | `isolation.lastDisabledAt` | string | Output field: isolation.lastDisabledAt | | `isolation.lastDisabledBy` | object | Output field: isolation.lastDisabledBy | | `isolation.lastDisabledBy.id` | string | Unique identifier | | `isolation.lastDisabledBy.type` | string | Type of the resource | | `isolation.lastDisabledBy.name` | string | Name of the resource | | `isolation.lastDisabledBy.accountType` | string | Type of the resource | | `isolation.lastDisabledBy.accountId` | string | Unique identifier | | `isolation.comment` | string | Output field: isolation.comment | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"123e4567-e89b-12d3-a456-426614174000","isolation":{"enabled":true,"lastEnabledAt":"2024-06-25T15:30:00Z","lastEnabledBy":{},"lastDisabledAt":"2024-06-24T12:00:00Z","lastDisabledBy":{},"comment":"Endpoint isolated due to security incident."}}}` ## List Alert Actions Retrieve a list of actions taken on a specific alert in Sophos Central using the alertId. ### Endpoint - **URL:** `/common/v1/alerts/{{alertId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------- | | `path_parameters.alertId` | string | Required | Alert ID. | ### Input Example `{"path_parameters":{"alertId":"a5ded91c-6575-435c-a6b4-64b94f9048ff"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `allowedActions` | array | Output field: allowedActions | | `category` | string | Output field: category | | `description` | string | Output field: description | | `groupKey` | string | Output field: groupKey | | `managedAgent` | object | Output field: managedAgent | | `managedAgent.id` | string | Unique identifier | | `managedAgent.type` | string | Type of the resource | | `person` | object | Output field: person | | `person.id` | string | Unique identifier | | `product` | string | Output field: product | | `raisedAt` | string | Output field: raisedAt | | `severity` | string | Output field: severity | | `tenant` | object | Output field: tenant | | `tenant.id` | string | Unique identifier | | `tenant.name` | string | Name of the resource | | `type` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"a5ded91c-6575-435c-a6b4-64b94f9048ff","allowedActions":["acknowledge"],"category":"updating","description":"John-PC is out of date.","groupKey":"MSxFdmVudDo6RW5kcG9pbnQ6Ok91dE9mRGF0ZSw1MTMs","managedAgent":{"id":"bb90527d-73a8-4e6e-85c6-20c2e0c5bc6f","type":"computer"},"person":{"id":"17dd896f-ee9f-4f7d-a2a2-6a8c0b48ff15"},"product":"endpoint","raisedAt":"2021-02-12T15:04:53.780Z","severity":"medium","tenant":{"id":"79067f...` ## Scan Endpoints Initiates or configures a scan on a specified endpoint using its endpointId in Sophos Central. ### Endpoint - **URL:** `/endpoint/v1/endpoints/{{endpointId}}/scans` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------- | | `path_parameters.endpointId` | string | Required | Endpoint ID. | ### Input Example `{"json_body":{},"path_parameters":{"endpointId":"416e722a-4ee3-4e81-98c0-a5489ee23fc6"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `status` | string | Status value | | `requestedAt` | string | Output field: requestedAt | ### Output Example `{"status_code":201,"response_headers":{"Date":"Tue, 25 Jun 2024 07:33:17 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Correlation-ID":"5304dbd8-ac5b-4915-b296-3e26c94cd5ff","X-Request-ID":"4028517a-90cc-47e5-870a-1e52ff3ef064"},"reason":"","json_body":{"id":"416e722a-4ee3-4e81-98c0-a5489ee23fc6","status":"requested","requestedAt":"2024-06-25T07:33:16.990060040Z"}}` # Response Headers | **Header** | **Description** | **Example** | | ----------------- | ----------------------------------------------------- | ------------------------------------ | | Connection | HTTP response header: Connection | keep-alive | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Tue, 25 Jun 2024 08:37:17 GMT | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | X-Correlation-ID | A unique identifier for correlating requests | 5304dbd8-ac5b-4915-b296-3e26c94cd5ff | | X-Request-ID | A unique identifier for the request | 49f7d5e4-c3b0-4314-a965-a3338b232b09 |