External DocumentationTo learn more, visit the Sophos documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Health Status | Find endpoints by health status. |
| Hostname Contains | Find endpoints where the hostname contains the given string. Only the first 10 characters of the given string are matched. |
| Isolation Status | Find endpoints by isolation status. |
| Lockdown Status | Find endpoints by lockdown status. |
| Search | Term to search for in the specified search fields. |
| Sort | A comma-separated list of sorting criteria, for example: lastSeenAs:asc,hostname:desc. For more information about this parameter, refer to Sophos’s documentation. |
| Type | A comma-separated list of types to query the endpoints by. |
| View | Type of view to be returned in response. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Associated Person Contains | Find endpoints where the name of the person associated with the endpoint contains the given string. Only the first 10 characters of the given string are matched. |
| Cloud | Find endpoints that are cloud instances. You must use URL encoding. |
| Fields | The fields to return in a partial response. |
| Group IDs | A comma-separated list of group IDs to query endpoints by. |
| Group Name Contains | Find endpoints where the name of the group the endpoint is in contains the given string. Only the first 10 characters of the given string are matched. |
| IDs | A comma-separated list of IDs to query the endpoints by. |
| IP Addresses | A comma-separated list of IP addresses to query the endpoints by. |
| Last Seen After | Find endpoints that were last seen after the given date and time (UTC) or a duration relative to the current date and time (inclusive). |
| Last Seen Before | Find endpoints that were last seen before the given date and time (UTC) or a duration relative to the current date and time (exclusive). |
| MAC Addresses | A comma separated list of MAC Addresses to query the endpoints by. Note: Can be in EUI-48 or EUI-64 format, case insensitive, colon, hyphen or dot separated, or with no separator e.g. 01:23:45:67:89:AB, 01-23-45-67-89-ab, 0123.4567.89ab, 0123456789ab, 01:23:45:67:89:ab:cd:ef. |
| Page From Key | The key of the item from where to fetch a page. |
| Page Size | The size of the page requested. |
| Page Total | Whether the number of pages should be calculated and returned in the response. |
| Search Fields | A comma-separated list of fields for finding the given search term. Defaults to all applicable fields. |
| Tamper Protection Enabled | Find endpoints by whether Tamper Protection is turned on. |
Example Output
{
"items": [
{
"assignedProducts": [
{
"code": "Endpoint product.",
"status": "Installation status of a product assigned to the endpoint.",
"version": "Version of a product assigned to an endpoint."
}
],
"associatedPerson": {
"id": "Unique ID for the Person.",
"name": "Person's name.",
"viaLogin": "Person's login on the endpoint."
},
"cloud": {
"instanceId": "Unique ID for the cloud instance.",
"provider": "Cloud provider in which the endpoint is running."
},
"encryption": {
"volumes": [
{
"status": "Endpoint volume encryption status.",
"volumeId": "Endpoint volume ID."
}
]
},
"group": {
"id": "Unique ID for endpoint group.",
"name": "Endpoint group name."
},
"health": {
"overall": "Health status of an endpoint or a service running on an endpoint.",
"services": {
"serviceDetails": [
{
"name": "Service name.",
"status": "Status of a service on an endpoint."
}
],
"status": "Health status of an endpoint or a service running on an endpoint."
},
"threats": {
"status": "Health status of an endpoint or a service running on an endpoint."
}
},
"hostname": "Hostname of the endpoint.",
"id": "Unique ID for the endpoint.",
"ipv4Addresses": [
"string"
],
"ipv6Addresses": [
"string"
],
"isolation": {
"adminIsolated": false,
"selfIsolated": false,
"status": "Isolation status reported by endpoint."
},
"lastSeenAt": "2019-09-23T12:02:01.700Z",
"lockdown": {
"status": "Endpoint lockdown status.",
"updateStatus": "Endpoint lockdown update status."
},
"macAddresses": [
"string"
],
"online": false,
"os": {
"build": 0,
"isServer": false,
"majorVersion": 0,
"minorVersion": 0,
"name": "OS name as reported by the endpoint.",
"platform": "OS platform type."
},
"tamperProtectionEnabled": false,
"tenant": {
"id": "The ID of the referenced object."
},
"type": "Endpoint type."
}
],
"pages": {
"fromKey": "The key of the first item in the returned page.",
"items": 0,
"maxSize": 0,
"nextKey": "The key to use when fetching the next page.",
"size": 0,
"total": 0
}
}
Workflow Library Example
List Endpoints with Sophos and Send Results Via Email