​
Basic Parameters​

ParameterDescription
Health StatusFind endpoints by health status.
Hostname ContainsFind endpoints where the hostname contains the given string. Only the first 10 characters of the given string are matched.
Isolation StatusFind endpoints by isolation status.
Lockdown StatusFind endpoints by lockdown status.
SearchTerm to search for in the specified search fields.
TypeFind endpoints by type.
ViewType of view to be returned in response.

​
Advanced Parameters​

ParameterDescription
Assigned To GroupWhether endpoint is assigned to a group.
Associated Person ContainsFind endpoints where the name of the person associated with the endpoint contains the given string. Only the first 10 characters of the given string are matched.
CloudFind endpoints that are cloud instances. You must use URL encoding.
FieldsThe fields to return in a partial response.
Group IDMatch endpoints by assigned group.
Group Name ContainsFind endpoints where the name of the group the endpoint is in contains the given string. Only the first 10 characters of the given string are matched.
IDFind endpoints with the specified IDs.
IP AddressesFind endpoints by IP addresses.
Last Seen AfterFind endpoints that were last seen after the given date and time (UTC) or a duration relative to the current date and time (inclusive).
Last Seen BeforeFind endpoints that were last seen before the given date and time (UTC) or a duration relative to the current date and time (exclusive).
MAC AddressesFind endpoints by MAC Addresses. Can be in EUI-48 or EUI-64 format, case insensitive, colon, hyphen or dot separated, or with no separator e.g. 01:23:45:67:89:AB, 01-23-45-67-89-ab, 0123.4567.89ab, 0123456789ab, 01:23:45:67:89🆎cd:ef.
Page From KeyThe key of the item from where to fetch a page.
Page SizeThe size of the page requested.
Page TotalWhether the number of pages should be calculated and returned in the response.
Search FieldsList of search fields for finding the given search term. Defaults to all applicable fields.
SortDefines how to sort the data.
Tamper Protection EnabledFind endpoints by whether Tamper Protection is turned on.

​
Example Output​

{    "items": [        {            "assignedProducts": [                {                    "code": "Endpoint product.",                    "status": "Installation status of a product assigned to the endpoint.",                    "version": "Version of a product assigned to an endpoint."                }            ],            "associatedPerson": {                "id": "Unique ID for the Person.",                "name": "Person's name.",                "viaLogin": "Person's login on the endpoint."            },            "cloud": {                "instanceId": "Unique ID for the cloud instance.",                "provider": "Cloud provider in which the endpoint is running."            },            "encryption": {                "volumes": [                    {                        "status": "Endpoint volume encryption status.",                        "volumeId": "Endpoint volume ID."                    }                ]            },            "group": {                "id": "Unique ID for endpoint group.",                "name": "Endpoint group name."            },            "health": {                "overall": "Health status of an endpoint or a service running on an endpoint.",                "services": {                    "serviceDetails": [                        {                            "name": "Service name.",                            "status": "Status of a service on an endpoint."                        }                    ],                    "status": "Health status of an endpoint or a service running on an endpoint."                },                "threats": {                    "status": "Health status of an endpoint or a service running on an endpoint."                }            },            "hostname": "Hostname of the endpoint.",            "id": "Unique ID for the endpoint.",            "ipv4Addresses": [                "string"            ],            "ipv6Addresses": [                "string"            ],            "isolation": {                "adminIsolated": false,                "selfIsolated": false,                "status": "Isolation status reported by endpoint."            },            "lastSeenAt": "2019-09-23T12:02:01.700Z",            "lockdown": {                "status": "Endpoint lockdown status.",                "updateStatus": "Endpoint lockdown update status."            },            "macAddresses": [                "string"            ],            "online": false,            "os": {                "build": 0,                "isServer": false,                "majorVersion": 0,                "minorVersion": 0,                "name": "OS name as reported by the endpoint.",                "platform": "OS platform type."            },            "tamperProtectionEnabled": false,            "tenant": {                "id": "The ID of the referenced object."            },            "type": "Endpoint type."        }    ],    "pages": {        "fromKey": "The key of the first item in the returned page.",        "items": 0,        "maxSize": 0,        "nextKey": "The key to use when fetching the next page.",        "size": 0,        "total": 0    }}

​
Workflow Library Example​

List Endpoints with Sophos and Send Results Via Email

Preview this Workflow on desktop

Was this page helpful?

Get EventsSophos Custom Action