Sophos

Sophos is a global cybersecurity leader delivering advanced endpoint protection, network security, cloud security, and SIEM integration through the Sophos Central platform. The Sophos Central API enables partners, organizations, and tenants to automate security operations including alert management, event retrieval, endpoint policy enforcement, and threat response.

1 APIs 0 Features

CybersecurityEndpoint ProtectionSecuritySIEMThreat DetectionIncident Response

APIs

Sophos Central SIEM API

The Sophos Central SIEM API provides access to security alerts and events for automating threat detection, incident response, and SIEM integration workflows. Retrieve real-time ...

Collections

Sophos Central SIEM API

OPEN

Pricing Plans

Sophos Plans Pricing

3 plans

PLANS

Rate Limits

Sophos Rate Limits

5 limits

RATE LIMITS

FinOps

Sophos Finops

FINOPS

Semantic Vocabularies

Sophos Context

4 classes · 11 properties

JSON-LD

API Governance Rules

Sophos API Rules

10 rules · 3 errors 6 warnings 1 info

SPECTRAL

JSON Structure

Sophos Alerts Response Structure

0 properties

JSON STRUCTURE

Example Payloads

Sophos List Alerts Example

2 fields

EXAMPLE

Resources

Documentation

PostmanCollection

PostmanCollection

Sources

opencollection: 1.0.0
info:
  name: Sophos Central SIEM API
  version: v1
request:
  auth:
    type: apikey
    key: x-api-key
    value: '{{x-api-key}}'
    placement: header
items:
- info:
    name: Alerts
    type: folder
  items:
  - info:
      name: List Security Alerts
      type: http
    http:
      method: GET
      url: https://api1.central.sophos.com/gateway/siem/v1/alerts
      headers:
      - name: x-api-key
        value: ''
      - name: Authorization
        value: ''
      - name: X-Timestamp
        value: ''
      params:
      - name: cursor
        value: ''
        type: query
        description: Pagination cursor identifier for fetching the next page of results
      - name: from_date
        value: ''
        type: query
        description: Unix timestamp in UTC specifying the start date for alerts. Must be within the last 24 hours.
      - name: from_date_offset_minutes
        value: ''
        type: query
        description: Delay data collection by the specified number of minutes. Useful for avoiding data gaps.
      - name: limit
        value: ''
        type: query
        description: Maximum number of alerts to return. Default is 200, maximum is 1000.
    docs: Retrieve security alerts for the customer based on the parameters provided. Alerts are retrieved within the last
      24 hours.
- info:
    name: Events
    type: folder
  items:
  - info:
      name: List Security Events
      type: http
    http:
      method: GET
      url: https://api1.central.sophos.com/gateway/siem/v1/events
      headers:
      - name: x-api-key
        value: ''
      - name: Authorization
        value: ''
      - name: X-Timestamp
        value: ''
      params:
      - name: cursor
        value: ''
        type: query
        description: Pagination cursor identifier for fetching the next page of results
      - name: from_date
        value: ''
        type: query
        description: Unix timestamp in UTC specifying the start date for events. Must be within the last 24 hours.
      - name: from_date_offset_minutes
        value: ''
        type: query
        description: Delay data collection by the specified number of minutes.
      - name: limit
        value: ''
        type: query
        description: Maximum number of events to return. Default is 200, maximum is 1000.
      - name: exclude_types
        value: ''
        type: query
        description: Comma-separated list of event types to exclude from the response
    docs: Retrieve security events for the customer based on the parameters provided. Events are retrieved within the last
      24 hours.
bundled: true