openapi: 3.0.0 info: title: Sophos SIEM API description: >- This is the OAS 3.0 specification for the SIEM Integration API in Sophos Central. This API powers the siem.py tool at https://github.com/sophos/Sophos-Central-SIEM-Integration. version: 1.0.0 contact: name: Sophos Central APIs email: apis@sophos.com url: 'https://developer.sophos.com' termsOfService: 'https://www.sophos.com/en-us/legal/sophos-end-user-license-agreement.aspx' license: name: Sophos Central License url: 'https://www.sophos.com/en-us/legal/sophos-professional-services.aspx' tags: - name: Alerts description: Retrieve alerts for a given customer. - name: Events description: Retrieve events for a given customer. servers: - url: 'https://api-{dataRegion}.central.sophos.com/siem/v1' description: Regional service in the production environment. variables: dataRegion: description: The data region where tenant data is stored. default: eu01 enum: - eu01 - eu02 - us01 - us03 - ca01 - au01 - jp01 - in01 - br01 - ae01 security: - bearerAuth: [] paths: /alerts: get: tags: - Alerts summary: Get alerts description: Get alert with timestamps within last 24 hours. operationId: getAlerts parameters: - name: limit in: query description: 'The maximum number of items to return, default is 200, max is 1000.' schema: maximum: 1000 minimum: 200 type: integer format: int32 default: 200 - name: from_date in: query description: >- The starting date from which alerts will be retrieved defined as Unix timestamp in UTC. Ignored if cursor is set. Must be within last 24 hours. schema: type: integer format: int64 - name: cursor in: query description: >- Identifier for next item in the list, this value is available in response as next_cursor. Response will default to last 24 hours if cursor is not within last 24 hours. schema: type: string - name: X-Tenant-ID description: >- The tenant ID. Required when using Bearer Token based authentication. in: header required: true schema: type: string - name: from_date_offset_minutes in: query description: Delay the data collection by X minutes from API. schema: maximum: 1440 minimum: 0 type: integer format: int32 default: 0 responses: '200': description: Succeeded. content: application/json: schema: type: object properties: has_more: type: boolean items: type: array items: type: object properties: created_at: type: string description: The date at which the alert was created. customer_id: type: string description: >- The unique identifier of the customer linked with this record. data: type: object additionalProperties: type: object properties: {} description: type: string description: The description of the alert that was generated. event_service_event_id: type: string description: The Event Services event id. id: type: string description: Identifier for the alert. info: type: object additionalProperties: type: object properties: {} location: type: string description: The location captured for this record. severity: type: string description: The severity for this alert. enum: - LOW - MEDIUM - HIGH source: type: string description: Describes the source from alert was generated. threat: type: string description: >- The name of the threat responsible for the generation of alert. threat_cleanable: type: boolean type: type: string description: >- Describes the type of the device on which alert was generated. when: type: string description: The date at which the alert was created. description: >- This model wraps up an Alert. This contains various fields that contain information regarding the alert that was generated. next_cursor: type: string description: >- Value of the next cursor. This will be used to make next call of API. description: Sophos Central Alert Model. '400': description: Bad Request. content: {} '401': description: Authentication Failed. content: {} '403': description: Forbidden. content: {} '404': description: Not Found. content: {} '500': description: Internal Server Error. content: {} /events: get: tags: - Events summary: Get events description: Get events with timestamps within last 24 hours. operationId: getEvents parameters: - name: limit in: query description: 'The maximum number of items to return, default is 200, max is 1000.' schema: maximum: 1000 minimum: 200 type: integer format: int32 default: 200 - name: cursor in: query description: >- Identifier for next item in the list, this value is available in response as next_cursor. Response will default to last 24 hours if cursor is not within last 24 hours. schema: type: string - name: from_date in: query description: >- The starting date from which alerts will be retrieved defined as Unix timestamp in UTC.Ignored if cursor is set. Must be within last 24 hours. schema: type: integer format: int64 - name: exclude_types in: query description: The String of list of types of events to be excluded. schema: type: string - name: X-Tenant-ID description: >- The tenant ID. Required when using Bearer Token based authentication. in: header required: true schema: type: string - name: from_date_offset_minutes in: query description: Delay the data collection by X minutes from API. schema: maximum: 1440 minimum: 0 type: integer format: int32 default: 0 responses: '200': description: Succeeded. content: application/json: schema: type: object properties: has_more: type: boolean items: type: array items: type: object properties: amsi_threat_data: type: object properties: parentProcessId: type: string parentProcessPath: type: string processId: type: string processName: type: string processPath: type: string appCerts: type: array description: >- Certificate info of the application associated with the threat, if available. items: type: object properties: signer: type: string thumbprint: type: string appSha256: type: string description: >- SHA 256 hash of the application associated with the threat, if available. core_remedy_items: type: object properties: items: type: array items: type: object properties: descriptor: type: string result: type: string enum: - NOT_APPLICABLE - SUCCESS - NOT_FOUND - DELETED - FAILED_TO_DELETE - WHITELISTED - OTHER_ERROR - FAILED_TO_DELETE_SYSTEM_PROTECTED type: type: string totalItems: type: integer format: int32 created_at: type: string description: The date at which the event was created. customer_id: type: string description: >- The identifier of the customer for which record is created. details: type: array items: type: object properties: property: type: string type: type: string enum: - CORE_EVENT_REQUEST_ID - CORE_EVENT_RESPONSE_STATUS - HMPA_EVENT_REPORT - HMPA_EVENT_TYPE - HMPA_PROCESS_VERSION - HMPA_PROCESS_PID - HMPA_PROCESS_PATH - HOME_FAMILY_ID - HOME_SCAN_LABEL - HOME_SCAN_STATE - HOME_SCAN_CLEAN - HOME_SCAN_REBOOT - HOME_COOKIES_COUNT - HOME_COOKIES_DOMAINS - HOME_REMNANT_FAMILY - HOME_REMNANT_NAME - HOME_REMNANT_PATHS - IPS_EXECUTABLE_PATH - IPS_EXECUTABLE_PID - IPS_EXECUTABLE_VERSION - IPS_EXECUTABLE_NAME - IPS_RAW_DATA - IPS_REMOTE_IP - IPS_REMOTE_PORT - IPS_LOCAL_PORT - IPS_TECH_SUPPORT_ID - AMSI_PROCESS_NAME - AMSI_PROCESS_ID - AMSI_PROCESS_PATH - AMSI_PARENT_PROCESS_ID - AMSI_PARENT_PROCESS_PATH - AMSI_THREAT_SUB_TYPE endpoint_id: type: string description: >- The corresponding endpoint id associated with the record. endpoint_type: type: string description: >- The corresponding endpoint type associated with the record. group: type: string description: The group associated with the group. id: type: string description: The Identifier for the event. ips_threat_data: type: object properties: detectionType: type: integer format: int32 executableName: type: string executablePath: type: string executablePid: type: string executableVersion: type: string localPort: type: string rawData: type: string remoteIp: type: string remotePort: type: string techSupportId: type: string location: type: string description: The location captured for this record. name: type: string description: The name of the record created. origin: type: string description: originating component of a detection. severity: type: string description: The severity for this alert. enum: - NONE - LOW - MEDIUM - HIGH - CRITICAL source: type: string description: The source for this record. source_info: type: object additionalProperties: type: string description: Detailed source information for this record. threat: type: string description: The threat associated with the record. type: type: string description: The type of this record. user_id: type: string description: >- The identifier of the user for which record is created. when: type: string description: The date at which the event was created. whitelist_properties: type: array items: type: object properties: property: type: string type: type: string enum: - SHA_256 - CERTIFICATE_SIGNER - PATH - THUMBPRINT - PROCESS_NAME - MITIGATION - DETECTION_KEY description: >- This model wraps up an Event. This contains various fields that contain information regarding the event that was generated. next_cursor: type: string description: >- Value of the next cursor. This will be used to make next call of API. description: Sophos Central Event Model. '400': description: Bad Request. content: {} '401': description: Authentication Failed. content: {} '403': description: Forbidden. content: {} '404': description: Not Found. content: {} '500': description: Internal Server Error. content: {} components: schemas: AlertAggregate: type: object properties: has_more: type: boolean items: type: array items: type: object properties: created_at: type: string description: The date at which the alert was created. customer_id: type: string description: The unique identifier of the customer linked with this record. data: type: object additionalProperties: type: object properties: {} description: type: string description: The description of the alert that was generated. event_service_event_id: type: string description: The Event Services event id. id: type: string description: Identifier for the alert. info: type: object additionalProperties: type: object properties: {} location: type: string description: The location captured for this record. severity: type: string description: The severity for this alert. enum: - LOW - MEDIUM - HIGH source: type: string description: Describes the source from alert was generated. threat: type: string description: >- The name of the threat responsible for the generation of alert. threat_cleanable: type: boolean type: type: string description: Describes the type of the device on which alert was generated. when: type: string description: The date at which the alert was created. description: >- This model wraps up an Alert. This contains various fields that contain information regarding the alert that was generated. next_cursor: type: string description: >- Value of the next cursor. This will be used to make next call of API. description: Sophos Central Alert Model. IpsThreatData: type: object properties: detectionType: type: integer format: int32 executableName: type: string executablePath: type: string executablePid: type: string executableVersion: type: string localPort: type: string rawData: type: string remoteIp: type: string remotePort: type: string techSupportId: type: string EndpointCoreEventCertificate: type: object properties: signer: type: string thumbprint: type: string EventDetailProperty: type: object properties: property: type: string type: type: string enum: - CORE_EVENT_REQUEST_ID - CORE_EVENT_RESPONSE_STATUS - HMPA_EVENT_REPORT - HMPA_EVENT_TYPE - HMPA_PROCESS_VERSION - HMPA_PROCESS_PID - HMPA_PROCESS_PATH - HOME_FAMILY_ID - HOME_SCAN_LABEL - HOME_SCAN_STATE - HOME_SCAN_CLEAN - HOME_SCAN_REBOOT - HOME_COOKIES_COUNT - HOME_COOKIES_DOMAINS - HOME_REMNANT_FAMILY - HOME_REMNANT_NAME - HOME_REMNANT_PATHS - IPS_EXECUTABLE_PATH - IPS_EXECUTABLE_PID - IPS_EXECUTABLE_VERSION - IPS_EXECUTABLE_NAME - IPS_RAW_DATA - IPS_REMOTE_IP - IPS_REMOTE_PORT - IPS_LOCAL_PORT - IPS_TECH_SUPPORT_ID - AMSI_PROCESS_NAME - AMSI_PROCESS_ID - AMSI_PROCESS_PATH - AMSI_PARENT_PROCESS_ID - AMSI_PARENT_PROCESS_PATH - AMSI_THREAT_SUB_TYPE EventAggregate: type: object properties: has_more: type: boolean items: type: array items: type: object properties: amsi_threat_data: type: object properties: parentProcessId: type: string parentProcessPath: type: string processId: type: string processName: type: string processPath: type: string appCerts: type: array description: >- Certificate info of the application associated with the threat, if available. items: type: object properties: signer: type: string thumbprint: type: string appSha256: type: string description: >- SHA 256 hash of the application associated with the threat, if available. core_remedy_items: type: object properties: items: type: array items: type: object properties: descriptor: type: string result: type: string enum: - NOT_APPLICABLE - SUCCESS - NOT_FOUND - DELETED - FAILED_TO_DELETE - WHITELISTED - OTHER_ERROR - FAILED_TO_DELETE_SYSTEM_PROTECTED type: type: string totalItems: type: integer format: int32 created_at: type: string description: The date at which the event was created. customer_id: type: string description: The identifier of the customer for which record is created. details: type: array items: type: object properties: property: type: string type: type: string enum: - CORE_EVENT_REQUEST_ID - CORE_EVENT_RESPONSE_STATUS - HMPA_EVENT_REPORT - HMPA_EVENT_TYPE - HMPA_PROCESS_VERSION - HMPA_PROCESS_PID - HMPA_PROCESS_PATH - HOME_FAMILY_ID - HOME_SCAN_LABEL - HOME_SCAN_STATE - HOME_SCAN_CLEAN - HOME_SCAN_REBOOT - HOME_COOKIES_COUNT - HOME_COOKIES_DOMAINS - HOME_REMNANT_FAMILY - HOME_REMNANT_NAME - HOME_REMNANT_PATHS - IPS_EXECUTABLE_PATH - IPS_EXECUTABLE_PID - IPS_EXECUTABLE_VERSION - IPS_EXECUTABLE_NAME - IPS_RAW_DATA - IPS_REMOTE_IP - IPS_REMOTE_PORT - IPS_LOCAL_PORT - IPS_TECH_SUPPORT_ID - AMSI_PROCESS_NAME - AMSI_PROCESS_ID - AMSI_PROCESS_PATH - AMSI_PARENT_PROCESS_ID - AMSI_PARENT_PROCESS_PATH - AMSI_THREAT_SUB_TYPE endpoint_id: type: string description: The corresponding endpoint id associated with the record. endpoint_type: type: string description: The corresponding endpoint type associated with the record. group: type: string description: The group associated with the group. id: type: string description: The Identifier for the event. ips_threat_data: type: object properties: detectionType: type: integer format: int32 executableName: type: string executablePath: type: string executablePid: type: string executableVersion: type: string localPort: type: string rawData: type: string remoteIp: type: string remotePort: type: string techSupportId: type: string location: type: string description: The location captured for this record. name: type: string description: The name of the record created. origin: type: string description: originating component of a detection. severity: type: string description: The severity for this alert. enum: - NONE - LOW - MEDIUM - HIGH - CRITICAL source: type: string description: The source for this record. source_info: type: object additionalProperties: type: string description: Detailed source information for this record. threat: type: string description: The threat associated with the record. type: type: string description: The type of this record. user_id: type: string description: The identifier of the user for which record is created. when: type: string description: The date at which the event was created. whitelist_properties: type: array items: type: object properties: property: type: string type: type: string enum: - SHA_256 - CERTIFICATE_SIGNER - PATH - THUMBPRINT - PROCESS_NAME - MITIGATION - DETECTION_KEY description: >- This model wraps up an Event. This contains various fields that contain information regarding the event that was generated. next_cursor: type: string description: >- Value of the next cursor. This will be used to make next call of API. description: Sophos Central Event Model. AlertEntity: type: object properties: created_at: type: string description: The date at which the alert was created. customer_id: type: string description: The unique identifier of the customer linked with this record. data: type: object additionalProperties: type: object properties: {} description: type: string description: The description of the alert that was generated. event_service_event_id: type: string description: The Event Services event id. id: type: string description: Identifier for the alert. info: type: object additionalProperties: type: object properties: {} location: type: string description: The location captured for this record. severity: type: string description: The severity for this alert. enum: - LOW - MEDIUM - HIGH source: type: string description: Describes the source from alert was generated. threat: type: string description: The name of the threat responsible for the generation of alert. threat_cleanable: type: boolean type: type: string description: Describes the type of the device on which alert was generated. when: type: string description: The date at which the alert was created. description: >- This model wraps up an Alert. This contains various fields that contain information regarding the alert that was generated. AmsiThreatData: type: object properties: parentProcessId: type: string parentProcessPath: type: string processId: type: string processName: type: string processPath: type: string CoreRemedyItems: type: object properties: items: type: array items: type: object properties: descriptor: type: string result: type: string enum: - NOT_APPLICABLE - SUCCESS - NOT_FOUND - DELETED - FAILED_TO_DELETE - WHITELISTED - OTHER_ERROR - FAILED_TO_DELETE_SYSTEM_PROTECTED type: type: string totalItems: type: integer format: int32 EndpointWhitelistProperties: type: object properties: property: type: string type: type: string enum: - SHA_256 - CERTIFICATE_SIGNER - PATH - THUMBPRINT - PROCESS_NAME - MITIGATION - DETECTION_KEY CoreRemedyItem: type: object properties: descriptor: type: string result: type: string enum: - NOT_APPLICABLE - SUCCESS - NOT_FOUND - DELETED - FAILED_TO_DELETE - WHITELISTED - OTHER_ERROR - FAILED_TO_DELETE_SYSTEM_PROTECTED type: type: string LegacyEventEntity: type: object properties: amsi_threat_data: type: object properties: parentProcessId: type: string parentProcessPath: type: string processId: type: string processName: type: string processPath: type: string appCerts: type: array description: >- Certificate info of the application associated with the threat, if available. items: type: object properties: signer: type: string thumbprint: type: string appSha256: type: string description: >- SHA 256 hash of the application associated with the threat, if available. core_remedy_items: type: object properties: items: type: array items: type: object properties: descriptor: type: string result: type: string enum: - NOT_APPLICABLE - SUCCESS - NOT_FOUND - DELETED - FAILED_TO_DELETE - WHITELISTED - OTHER_ERROR - FAILED_TO_DELETE_SYSTEM_PROTECTED type: type: string totalItems: type: integer format: int32 created_at: type: string description: The date at which the event was created. customer_id: type: string description: The identifier of the customer for which record is created. details: type: array items: type: object properties: property: type: string type: type: string enum: - CORE_EVENT_REQUEST_ID - CORE_EVENT_RESPONSE_STATUS - HMPA_EVENT_REPORT - HMPA_EVENT_TYPE - HMPA_PROCESS_VERSION - HMPA_PROCESS_PID - HMPA_PROCESS_PATH - HOME_FAMILY_ID - HOME_SCAN_LABEL - HOME_SCAN_STATE - HOME_SCAN_CLEAN - HOME_SCAN_REBOOT - HOME_COOKIES_COUNT - HOME_COOKIES_DOMAINS - HOME_REMNANT_FAMILY - HOME_REMNANT_NAME - HOME_REMNANT_PATHS - IPS_EXECUTABLE_PATH - IPS_EXECUTABLE_PID - IPS_EXECUTABLE_VERSION - IPS_EXECUTABLE_NAME - IPS_RAW_DATA - IPS_REMOTE_IP - IPS_REMOTE_PORT - IPS_LOCAL_PORT - IPS_TECH_SUPPORT_ID - AMSI_PROCESS_NAME - AMSI_PROCESS_ID - AMSI_PROCESS_PATH - AMSI_PARENT_PROCESS_ID - AMSI_PARENT_PROCESS_PATH - AMSI_THREAT_SUB_TYPE endpoint_id: type: string description: The corresponding endpoint id associated with the record. endpoint_type: type: string description: The corresponding endpoint type associated with the record. group: type: string description: The group associated with the group. id: type: string description: The Identifier for the event. ips_threat_data: type: object properties: detectionType: type: integer format: int32 executableName: type: string executablePath: type: string executablePid: type: string executableVersion: type: string localPort: type: string rawData: type: string remoteIp: type: string remotePort: type: string techSupportId: type: string location: type: string description: The location captured for this record. name: type: string description: The name of the record created. origin: type: string description: originating component of a detection. severity: type: string description: The severity for this alert. enum: - NONE - LOW - MEDIUM - HIGH - CRITICAL source: type: string description: The source for this record. source_info: type: object additionalProperties: type: string description: Detailed source information for this record. threat: type: string description: The threat associated with the record. type: type: string description: The type of this record. user_id: type: string description: The identifier of the user for which record is created. when: type: string description: The date at which the event was created. whitelist_properties: type: array items: type: object properties: property: type: string type: type: string enum: - SHA_256 - CERTIFICATE_SIGNER - PATH - THUMBPRINT - PROCESS_NAME - MITIGATION - DETECTION_KEY description: >- This model wraps up an Event. This contains various fields that contain information regarding the event that was generated. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT