Getting started
[!WARNING] The Classic XDR Detections REST API is deprecated
Don't use this API for new integrations. Existing integrations can continue to use the query examples below. This API is already read-only, and we will remove it at a later time.
Use the Detections GraphQL API guide for new integrations. Follow the Detections REST to GraphQL migration guide to plan your migration. See the Fusion XDR GraphQL APIs and Classic XDR API deprecation announcement for more information.
Overview¶
This guide explains how to use the Detections API. After reading this guide, you should be able to start detections and detection group query runs, check their status and get results.
Pre-requisites¶
You must have a set of API credentials (service principal) to be able to call the Detections API. For more information refer to the appropriate quick start guide:
- Sophos Partners: Read Partner Getting Started Guide.
- Enterprise customers: If you use Sophos Enterprise to manage multiple tenants, read the Organization Getting Started Guide.
- Other customers: Read Tenant Getting Started Guide.
Making API requests¶
You can make the API calls in the next few sections using cURL. Follow the instructions on cURL's website to install this tool.
When using curl, a request to the Endpoint API has the following general form:
curl -X <method> -H "Authorization: Bearer <jwt>" -H "X-Tenant-ID: <tenant-id>" <data-region>/<path>
The command includes the following placeholders:
<method>: The request method. For the Endpoint API, this is eitherGETorPOST.<jwt>: The JWT access token returned when the IDP authenticates the service principal.<tenant-id>: The ID of the tenant you want to query.<data-region>: The regional API host in the data geography where the tenant data is located.<path>: The request path for the API operation, for exampledetections/queries/detections/counts.
The API descriptions in this guide only specify the request method and path. For example:
POST detections/v1/queries/detections
All API requests return HTTP status codes 200 or 201 when successful.
Detection operations¶
Start detections query run¶
To start a detections query run, call:
POST detections/v1/queries/detections
{
"severity": [4,8,9],
"from": "2021-10-02T14:53:22.017Z",
"to": "2021-11-01T15:53:22.017Z"
}
Response: This returns a run ID.
{
"id": "38a372bf-c33c-4803-9427-99a3bd49a760",
"createdAt": "2021-11-01T16:10:04.574Z",
"result": "notAvailable",
"status": "pending"
}
Get detections query run status¶
Call:
GET detections/v1/queries/detections/{id}
Use this call to check the status of the given query execution. If the results are ready, status will be `finished` and result `succeeded`.
Response:
{
"id": "38a372bf-c33c-4803-9427-99a3bd49a760",
"createdAt": "2021-11-01T16:10:04.574Z",
"result": "notAvailable",
"status": "pending"
}
Get detections query run results¶
When the query has finished, the user can get the results.
GET detections/v1/queries/detections/{id}/results?page=1&pageSize=3
Response:
{
"items": [
{
"id": "0a82a026059f7c9a7890810e38d8547ac910eb5eac1e16b00b22e7d697c11219_442f9819197d0550bcdc8d69c882dc222ea975a1",
"attackType": "Security Event Service Detections",
"caseDescription": {
"correlatedReasonId": "",
"createdReasonId": ""
},
"detectionDescription": {
"createdReasonId": "WIN-PROT-BEHAVIORAL-MALWARE-EXEC-12B-T1059-001",
"significanceId": "WIN-PROT-BEHAVIORAL-MALWARE-EXEC-12B-T1059-001"
},
"detectionRule": "WIN-PROT-BEHAVIORAL-MALWARE-EXEC-12B-T1059-001",
"sensorGeneratedAt": "2025-03-19T02:07:16Z",
"sensor": {
"id": "SophosSensorID",
"type": "endpoint",
"source": "Sophos",
"version": "1.24.1.1"
},
"device": {
"id": "8028601a-c171-4114-8b19-b27df55ee8c8",
"type": "server",
"entity": "EC2AMAZ-HKOG4LG"
},
"detectionAttack": "Execution",
"detectionLicenses": "[\"MTR\",\"XDR\"]",
"geolocation": [
{
"fieldName": "raw.meta_public_ip",
"fieldValue": "44.242.188.182",
"city": "Boardman",
"state": "Oregon",
"country": "United States",
"countryCode": "US",
"postal": "97818",
"latitude": 45.8234,
"longitude": -119.7257
}
],
"entities": [
{
"id": "de61f7978f9209564b7236ce99383ea09f46ab86889df256788d6f1726591af2",
"type": "device",
"category": "impacted",
"attributes": {
"domain_controller": "False",
"endpoint_type": "server",
"hostname": "EC2AMAZ-HKOG4LG",
"id": "8028601a-c171-4114-8b19-b27df55ee8c8",
"mac_address": "06:be:26:88:2a:63",
"os_platform": "windows",
"os_type": ""
}
},
{
"id": "ffb1496fefdba5d585c864d9bec0f9a583fadb998d854812e2f20811b090a116",
"type": "ip_address",
"category": "impacted",
"attributes": {
"address": "44.242.188.182",
"external": true,
"id": "706c3045ff4d503273b0bd19c699f70df66134c3551d9119944f3f7a8a6f4e45",
"type": "ipv4"
}
},
{
"id": "c9e90f890eb4eb218b176f2a956a104604d45e1f57d6fa93a7e3e36af1419317",
"type": "ip_address",
"category": "impacted",
"attributes": {
"address": "10.0.1.108",
"external": false,
"id": "92699e51cc8f557c3f6c4f7f254c7b41a9dc0c9826eb972981c0077ff80b8de9",
"type": "ipv4"
}
},
{
"id": "c2c1476c81ad925731d8f98174d24c80530ac730c4b84f3560683631a4894ace",
"type": "user",
"category": "impacted",
"attributes": {
"id": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"sub_type": "logged_in_user",
"username": ""
}
}
],
"intelixFileReputation": [
{
"fieldName": "raw.process_sha256",
"fieldValue": "de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c",
"reputationScore": 98
}
],
"mitreAttacks": [
{
"tactic": {
"id": "TA0002",
"name": "Execution",
"techniques": [
{
"id": "T1059.001",
"name": "PowerShell"
}
]
}
}
],
"rawData": {
"meta_eid": "8028601a-c171-4114-8b19-b27df55ee8c8",
"meta_licence": "MTR",
"meta_public_ip": "44.242.188.182",
"meta_aggressive_activity": "False",
"meta_os_platform": "windows",
"meta_os_version": "10.0.17763",
"meta_domain_controller": "False",
"customer_region": "eu-west-1",
"meta_ip_address": "10.0.1.108",
"meta_query_pack_version": "1.24.1.1",
"meta_boot_time": 1742216182,
"meta_endpoint_type": "server",
"meta_hostname": "EC2AMAZ-HKOG4LG",
"meta_mac_address": "06:be:26:88:2a:63",
"meta_os_type": "",
"stream_ingest_time": "1742350054361",
"meta_os_name": "Microsoft Windows Server 2019 Datacenter",
"customer_id": "5fa5f0aa-1063-4c97-a739-2fad8700d84b",
"meta_ip_mask": "255.255.255.0",
"meta_username": "",
"osquery_action": "added",
"calendar_time": 1742350036000,
"item_type": "Process",
"process_parent_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"detection_item": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"detection_name": "Exec_12b (T1059.001)",
"process_local_rep_signers": "{\"reputationData\":{\"isSigned\":1,\"signerInfo\":[{\"isValid\":1,\"signer\":\"Microsoft Windows\"}]}}",
"sid": "",
"process_cmd_line": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -Command \"IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp HKCU:Software\\Microsoft\\Windows\\CurrentVersion Debug).Debug)))\"",
"process_name": "powershell.exe",
"monitor_mode": 0,
"threat_type": "Malware",
"process_cmd_line_truncated": 0,
"process_pua_score": 15,
"process_file_size": 448000,
"process_local_rep": 91,
"primary_item": "{\"cleanUp\":true,\"parentSpid\":{\"!spid\":\"[5008:133868235151434174]\"},\"path\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"primary\":true,\"spid\":{\"!spid\":\"[5520:133868235164715855]\"},\"type\":2}",
"sophos_pid": "5520:133868235164715855",
"associated_lineages": "",
"process_pid": 5520,
"detection_thumbprint": "395de2f08289e4aeb1cc300bbd31749ed48b684214497934947abc0bb7bc613d",
"process_ml_score_band": "LIKELY_BENIGN",
"process_ml_score": 8,
"threat_source": "Behavioral",
"process_parent_sophos_pid": "5008:133868235151434174",
"process_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"time": 1742349916,
"process_parent_name": "powershell.exe",
"process_sha256": "de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c",
"items": "[{\"cleanUp\":true,\"parentSpid\":{\"!spid\":\"[5008:133868235151434174]\"},\"path\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"primary\":true,\"spid\":{\"!spid\":\"[5520:133868235164715855]\"},\"type\":2}]",
"process_global_rep": -1,
"username": "",
"counter": 5,
"epoch": 1742317019,
"folded": 0,
"host_identifier": "EC2093A8-DFC1-CF5E-BBA6-595A50BB6629",
"query_name": "sophos_detections_windows",
"numerics": false,
"tag": "stream",
"unix_time": 1742350036000
},
"ruleDescription": "Execution behavior based protection from Sophos",
"severity": 8,
"suppressed": "false",
"time": "2025-03-19T02:07:40.361Z",
"type": "Threat"
},
{
"id": "b7f084d705fa99e67897716bcab5cd28f33c52fe10aaa351b45e4692f2f2fcb4_dabfb356133471e32f70f4b8272530e6c444baef",
"attackType": "Security Event Service Detections",
"caseDescription": {
"correlatedReasonId": "",
"createdReasonId": ""
},
"detectionDescription": {
"createdReasonId": "WIN-PROT-BEHAVIORAL-MALWARE-EXEC-12B-T1059-001",
"significanceId": "WIN-PROT-BEHAVIORAL-MALWARE-EXEC-12B-T1059-001"
},
"detectionRule": "WIN-PROT-BEHAVIORAL-MALWARE-EXEC-12B-T1059-001",
"sensorGeneratedAt": "2025-03-19T02:07:16Z",
"sensor": {
"id": "SophosSensorID",
"type": "endpoint",
"source": "Sophos",
"version": "1.24.1.1"
},
"device": {
"id": "8028601a-c171-4114-8b19-b27df55ee8c8",
"type": "server",
"entity": "EC2AMAZ-HKOG4LG"
},
"detectionAttack": "Execution",
"detectionLicenses": "[\"MTR\",\"XDR\"]",
"geolocation": [
{
"fieldName": "raw.meta_public_ip",
"fieldValue": "44.242.188.182",
"city": "Boardman",
"state": "Oregon",
"country": "United States",
"countryCode": "US",
"postal": "97818",
"latitude": 45.8234,
"longitude": -119.7257
}
],
"entities": [
{
"id": "de61f7978f9209564b7236ce99383ea09f46ab86889df256788d6f1726591af2",
"type": "device",
"category": "impacted",
"attributes": {
"domain_controller": "False",
"endpoint_type": "server",
"hostname": "EC2AMAZ-HKOG4LG",
"id": "8028601a-c171-4114-8b19-b27df55ee8c8",
"mac_address": "06:be:26:88:2a:63",
"os_platform": "windows",
"os_type": ""
}
},
{
"id": "ffb1496fefdba5d585c864d9bec0f9a583fadb998d854812e2f20811b090a116",
"type": "ip_address",
"category": "impacted",
"attributes": {
"address": "44.242.188.182",
"external": true,
"id": "706c3045ff4d503273b0bd19c699f70df66134c3551d9119944f3f7a8a6f4e45",
"type": "ipv4"
}
},
{
"id": "c9e90f890eb4eb218b176f2a956a104604d45e1f57d6fa93a7e3e36af1419317",
"type": "ip_address",
"category": "impacted",
"attributes": {
"address": "10.0.1.108",
"external": false,
"id": "92699e51cc8f557c3f6c4f7f254c7b41a9dc0c9826eb972981c0077ff80b8de9",
"type": "ipv4"
}
},
{
"id": "c2c1476c81ad925731d8f98174d24c80530ac730c4b84f3560683631a4894ace",
"type": "user",
"category": "impacted",
"attributes": {
"id": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"sub_type": "logged_in_user",
"username": ""
}
}
],
"intelixFileReputation": [
{
"fieldName": "raw.process_sha256",
"fieldValue": "de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c",
"reputationScore": 98
}
],
"mitreAttacks": [
{
"tactic": {
"id": "TA0002",
"name": "Execution",
"techniques": [
{
"id": "T1059.001",
"name": "PowerShell"
}
]
}
}
],
"rawData": {
"meta_eid": "8028601a-c171-4114-8b19-b27df55ee8c8",
"meta_licence": "MTR",
"meta_public_ip": "44.242.188.182",
"meta_aggressive_activity": "False",
"meta_os_platform": "windows",
"meta_os_version": "10.0.17763",
"meta_domain_controller": "False",
"customer_region": "eu-west-1",
"meta_ip_address": "10.0.1.108",
"meta_query_pack_version": "1.24.1.1",
"meta_boot_time": 1742216182,
"meta_endpoint_type": "server",
"meta_hostname": "EC2AMAZ-HKOG4LG",
"meta_mac_address": "06:be:26:88:2a:63",
"meta_os_type": "",
"stream_ingest_time": "1742350054361",
"meta_os_name": "Microsoft Windows Server 2019 Datacenter",
"customer_id": "5fa5f0aa-1063-4c97-a739-2fad8700d84b",
"meta_ip_mask": "255.255.255.0",
"meta_username": "",
"osquery_action": "added",
"calendar_time": 1742350036000,
"item_type": "Process",
"process_parent_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"detection_item": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"detection_name": "Exec_12b (T1059.001)",
"process_local_rep_signers": "{\"reputationData\":{\"isSigned\":1,\"signerInfo\":[{\"isValid\":1,\"signer\":\"Microsoft Windows\"}]}}",
"sid": "",
"process_cmd_line": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -Command \"IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp HKCU:Software\\Microsoft\\Windows\\CurrentVersion Debug).Debug)))\"",
"process_name": "powershell.exe",
"monitor_mode": 0,
"threat_type": "Malware",
"process_cmd_line_truncated": 0,
"process_pua_score": 15,
"process_file_size": 448000,
"process_local_rep": 91,
"primary_item": "{\"cleanUp\":true,\"parentSpid\":{\"!spid\":\"[5008:133868235151434174]\"},\"path\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"primary\":true,\"spid\":{\"!spid\":\"[3624:133868235163325420]\"},\"type\":2}",
"sophos_pid": "3624:133868235163325420",
"associated_lineages": "",
"process_pid": 3624,
"detection_thumbprint": "c1c106fd882f343f8ee63d984931ccb69329da21d8417448cfd1c7239ae344e0",
"process_ml_score_band": "LIKELY_BENIGN",
"process_ml_score": 8,
"threat_source": "Behavioral",
"process_parent_sophos_pid": "5008:133868235151434174",
"process_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"time": 1742349916,
"process_parent_name": "powershell.exe",
"process_sha256": "de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c",
"items": "[{\"cleanUp\":true,\"parentSpid\":{\"!spid\":\"[5008:133868235151434174]\"},\"path\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"primary\":true,\"spid\":{\"!spid\":\"[3624:133868235163325420]\"},\"type\":2}]",
"process_global_rep": -1,
"username": "",
"counter": 5,
"epoch": 1742317019,
"folded": 0,
"host_identifier": "EC2093A8-DFC1-CF5E-BBA6-595A50BB6629",
"query_name": "sophos_detections_windows",
"numerics": false,
"tag": "stream",
"unix_time": 1742350036000
},
"ruleDescription": "Execution behavior based protection from Sophos",
"severity": 8,
"suppressed": "false",
"time": "2025-03-19T02:07:40.361Z",
"type": "Threat"
},
{
"id": "81dd1575e1402636140fa4bc70d0ee0de66f92ffd77a7eb145f2a89dfef3685b_79500436d6c9a674b84dab97e839ef661666f6d5",
"attackType": "Security Event Service Detections",
"caseDescription": {
"correlatedReasonId": "",
"createdReasonId": ""
},
"detectionDescription": {
"createdReasonId": "WIN-PROT-BEHAVIORAL-MALWARE-EXEC-12B-T1059-001",
"significanceId": "WIN-PROT-BEHAVIORAL-MALWARE-EXEC-12B-T1059-001"
},
"detectionRule": "WIN-PROT-BEHAVIORAL-MALWARE-EXEC-12B-T1059-001",
"sensorGeneratedAt": "2025-03-19T02:07:16Z",
"sensor": {
"id": "SophosSensorID",
"type": "endpoint",
"source": "Sophos",
"version": "1.24.1.1"
},
"device": {
"id": "8028601a-c171-4114-8b19-b27df55ee8c8",
"type": "server",
"entity": "EC2AMAZ-HKOG4LG"
},
"detectionAttack": "Execution",
"detectionLicenses": "[\"MTR\",\"XDR\"]",
"geolocation": [
{
"fieldName": "raw.meta_public_ip",
"fieldValue": "44.242.188.182",
"city": "Boardman",
"state": "Oregon",
"country": "United States",
"countryCode": "US",
"postal": "97818",
"latitude": 45.8234,
"longitude": -119.7257
}
],
"entities": [
{
"id": "de61f7978f9209564b7236ce99383ea09f46ab86889df256788d6f1726591af2",
"type": "device",
"category": "impacted",
"attributes": {
"domain_controller": "False",
"endpoint_type": "server",
"hostname": "EC2AMAZ-HKOG4LG",
"id": "8028601a-c171-4114-8b19-b27df55ee8c8",
"mac_address": "06:be:26:88:2a:63",
"os_platform": "windows",
"os_type": ""
}
},
{
"id": "ffb1496fefdba5d585c864d9bec0f9a583fadb998d854812e2f20811b090a116",
"type": "ip_address",
"category": "impacted",
"attributes": {
"address": "44.242.188.182",
"external": true,
"id": "706c3045ff4d503273b0bd19c699f70df66134c3551d9119944f3f7a8a6f4e45",
"type": "ipv4"
}
},
{
"id": "c9e90f890eb4eb218b176f2a956a104604d45e1f57d6fa93a7e3e36af1419317",
"type": "ip_address",
"category": "impacted",
"attributes": {
"address": "10.0.1.108",
"external": false,
"id": "92699e51cc8f557c3f6c4f7f254c7b41a9dc0c9826eb972981c0077ff80b8de9",
"type": "ipv4"
}
},
{
"id": "c2c1476c81ad925731d8f98174d24c80530ac730c4b84f3560683631a4894ace",
"type": "user",
"category": "impacted",
"attributes": {
"id": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"sub_type": "logged_in_user",
"username": ""
}
}
],
"intelixFileReputation": [
{
"fieldName": "raw.process_sha256",
"fieldValue": "de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c",
"reputationScore": 98
}
],
"mitreAttacks": [
{
"tactic": {
"id": "TA0002",
"name": "Execution",
"techniques": [
{
"id": "T1059.001",
"name": "PowerShell"
}
]
}
}
],
"rawData": {
"meta_eid": "8028601a-c171-4114-8b19-b27df55ee8c8",
"meta_licence": "MTR",
"meta_public_ip": "44.242.188.182",
"meta_aggressive_activity": "False",
"meta_os_platform": "windows",
"meta_os_version": "10.0.17763",
"meta_domain_controller": "False",
"customer_region": "eu-west-1",
"meta_ip_address": "10.0.1.108",
"meta_query_pack_version": "1.24.1.1",
"meta_boot_time": 1742216182,
"meta_endpoint_type": "server",
"meta_hostname": "EC2AMAZ-HKOG4LG",
"meta_mac_address": "06:be:26:88:2a:63",
"meta_os_type": "",
"stream_ingest_time": "1742350054361",
"meta_os_name": "Microsoft Windows Server 2019 Datacenter",
"customer_id": "5fa5f0aa-1063-4c97-a739-2fad8700d84b",
"meta_ip_mask": "255.255.255.0",
"meta_username": "",
"osquery_action": "added",
"calendar_time": 1742350036000,
"item_type": "Process",
"process_parent_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"detection_item": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"detection_name": "Exec_12b (T1059.001)",
"process_local_rep_signers": "{\"reputationData\":{\"isSigned\":1,\"signerInfo\":[{\"isValid\":1,\"signer\":\"Microsoft Windows\"}]}}",
"sid": "",
"process_cmd_line": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -Command \"IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp HKCU:Software\\Microsoft\\Windows\\CurrentVersion Debug).Debug)))\"",
"process_name": "powershell.exe",
"monitor_mode": 0,
"threat_type": "Malware",
"process_cmd_line_truncated": 0,
"process_pua_score": 15,
"process_file_size": 448000,
"process_local_rep": 91,
"primary_item": "{\"cleanUp\":true,\"parentSpid\":{\"!spid\":\"[3420:133868234554888634]\"},\"path\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"primary\":true,\"spid\":{\"!spid\":\"[752:133868234566728947]\"},\"type\":2}",
"sophos_pid": "752:133868234566728947",
"associated_lineages": "",
"process_pid": 752,
"detection_thumbprint": "395de2f08289e4aeb1cc300bbd31749ed48b684214497934947abc0bb7bc613d",
"process_ml_score_band": "LIKELY_BENIGN",
"process_ml_score": 8,
"threat_source": "Behavioral",
"process_parent_sophos_pid": "3420:133868234554888634",
"process_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"time": 1742349856,
"process_parent_name": "powershell.exe",
"process_sha256": "de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c",
"items": "[{\"cleanUp\":true,\"parentSpid\":{\"!spid\":\"[3420:133868234554888634]\"},\"path\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"primary\":true,\"spid\":{\"!spid\":\"[752:133868234566728947]\"},\"type\":2}]",
"process_global_rep": -1,
"username": "",
"counter": 5,
"epoch": 1742317019,
"folded": 0,
"host_identifier": "EC2093A8-DFC1-CF5E-BBA6-595A50BB6629",
"query_name": "sophos_detections_windows",
"numerics": false,
"tag": "stream",
"unix_time": 1742350036000
},
"ruleDescription": "Execution behavior based protection from Sophos",
"severity": 8,
"suppressed": "false",
"time": "2025-03-19T02:07:40.361Z",
"type": "Threat"
}
],
"pages": {
"current": 1,
"size": 3,
"total": 300,
"items": 899,
"maxSize": 2000
}
}
Get detection counts¶
Get detection counts grouped by severity and type.
GET detections/v1/queries/detections/counts
Response:
{
"from": "2025-03-22T13:00:00Z",
"to": "2025-03-26T14:00:00Z",
"tenant": {
"id": "5fa5f0aa-1063-4c97-a739-2fad8700d84b"
},
"resolution": "hour",
"resolutionDetectionCounts": [
{
"startsAt": "2025-03-22T14:00:00Z",
"endsAt": "2025-03-22T15:00:00Z",
"totalCount": 22,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 12,
"high": 8,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 22,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-22T18:00:00Z",
"endsAt": "2025-03-22T19:00:00Z",
"totalCount": 22,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 12,
"high": 8,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 22,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-22T22:00:00Z",
"endsAt": "2025-03-22T23:00:00Z",
"totalCount": 22,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 12,
"high": 8,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 22,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-23T02:00:00Z",
"endsAt": "2025-03-23T03:00:00Z",
"totalCount": 23,
"countBySeverity": {
"info": 0,
"low": 1,
"medium": 12,
"high": 8,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 23,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-23T06:00:00Z",
"endsAt": "2025-03-23T07:00:00Z",
"totalCount": 22,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 12,
"high": 8,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 22,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-23T10:00:00Z",
"endsAt": "2025-03-23T11:00:00Z",
"totalCount": 26,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 15,
"high": 9,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 26,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-25T03:00:00Z",
"endsAt": "2025-03-25T04:00:00Z",
"totalCount": 22,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 12,
"high": 8,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 22,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-25T06:00:00Z",
"endsAt": "2025-03-25T07:00:00Z",
"totalCount": 22,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 12,
"high": 8,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 22,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-25T10:00:00Z",
"endsAt": "2025-03-25T11:00:00Z",
"totalCount": 26,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 15,
"high": 9,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 26,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-25T12:00:00Z",
"endsAt": "2025-03-25T13:00:00Z",
"totalCount": 1,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 0,
"high": 1,
"critical": 0
},
"countByType": {
"process": 0,
"threat": 1,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-25T14:00:00Z",
"endsAt": "2025-03-25T15:00:00Z",
"totalCount": 22,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 12,
"high": 8,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 22,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-25T18:00:00Z",
"endsAt": "2025-03-25T19:00:00Z",
"totalCount": 22,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 12,
"high": 8,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 22,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-25T22:00:00Z",
"endsAt": "2025-03-25T23:00:00Z",
"totalCount": 22,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 12,
"high": 8,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 22,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-26T02:00:00Z",
"endsAt": "2025-03-26T03:00:00Z",
"totalCount": 22,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 12,
"high": 8,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 22,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-26T06:00:00Z",
"endsAt": "2025-03-26T07:00:00Z",
"totalCount": 22,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 12,
"high": 8,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 22,
"vulnerability": 0
}
},
{
"startsAt": "2025-03-26T10:00:00Z",
"endsAt": "2025-03-26T11:00:00Z",
"totalCount": 26,
"countBySeverity": {
"info": 0,
"low": 0,
"medium": 15,
"high": 9,
"critical": 2
},
"countByType": {
"process": 0,
"threat": 26,
"vulnerability": 0
}
}
]
}
Detection group operations¶
Start detections group query run¶
To start a detections group query run, call:
POST detections/v1/queries/detection-groups
{
"severity": [ 7, 8, 9, 10 ],
"sort": [ { "field": "lastSeenAt", "direction": "desc"} ],
"from": "2021-10-31T15:46:57.240Z",
"to": "2021-11-01T15:46:57.240Z"
}
Response: This returns a run id.
{
"id": "38a372bf-c33c-4803-9427-99a3bd49a760",
"createdAt": "2021-11-01T16:10:04.574Z",
"result": "notAvailable",
"status": "pending"
}
Call:
Get detections group query run status¶
Use this call to check the status of the given query execution. If the results are ready, status will be `finished` and result `succeeded`.
GET detections/v1/queries/detection-groups/{id}
Response:
{
"id": "38a372bf-c33c-4803-9427-99a3bd49a760",
"createdAt": "2021-11-01T16:10:04.574Z",
"result": "notAvailable",
"status": "pending"
}
Get detections group query run results¶
When the query has finished,the user can get the results.
GET detections/v1/queries/detection-groups/{id}/results?page=1&pageSize=3
Response:
{
"items": [
{
"severity": 9,
"count": 2,
"detectionRule": "WIN-CRD-PRC-COMSVCS-MINIDUMP-2",
"sensor": {
"id": "SophosSensorID",
"type": "endpoint",
"source": "Sophos",
"version": "1.24.1.1"
},
"device": {
"id": "8028601a-c171-4114-8b19-b27df55ee8c8",
"type": "server",
"entity": "EC2AMAZ-HKOG4LG"
},
"time": "2025-03-19T02:07:01.827Z",
"detectionRuleDescription": "The MiniDumpW function of comsvcs.dll can be used to dump process memory, including lsass.exe. The function requires the PID of lsass.exe. In addition, the MiniDumpW function can be called using #24 or even the negative number representation #-4294967272 rather than its name. \n",
"mitreAttacks": [
{
"tactic": {
"id": "TA0003",
"name": "Persistence",
"techniques": [
{
"id": "T1078.002",
"name": "Domain Accounts"
},
{
"id": "T1078.003",
"name": "Local Accounts"
}
]
}
},
{
"tactic": {
"id": "TA0004",
"name": "Privilege Escalation",
"techniques": [
{
"id": "T1078.002",
"name": "Domain Accounts"
},
{
"id": "T1078.003",
"name": "Local Accounts"
}
]
}
},
{
"tactic": {
"id": "TA0005",
"name": "Defense Evasion",
"techniques": [
{
"id": "T1078.002",
"name": "Domain Accounts"
},
{
"id": "T1078.003",
"name": "Local Accounts"
}
]
}
},
{
"tactic": {
"id": "TA0006",
"name": "Credential Access",
"techniques": [
{
"id": "T1003",
"name": "OS Credential Dumping"
},
{
"id": "T1003.001",
"name": "LSASS Memory"
}
]
}
}
],
"type": "Threat"
},
{
"severity": 8,
"count": 1,
"detectionRule": "WIN-CRD-PRC-LSASS-DUMP-1",
"sensor": {
"id": "SophosSensorID",
"type": "endpoint",
"source": "Sophos",
"version": "1.24.1.1"
},
"device": {
"id": "8028601a-c171-4114-8b19-b27df55ee8c8",
"type": "server",
"entity": "EC2AMAZ-HKOG4LG"
},
"time": "2025-03-19T02:07:01.827Z",
"detectionRuleDescription": "Adversaries can utilize living off the land techniques (Rundll32 comsvcs.dll MiniDump technique) or common 3rd party tools (Sysinternals ProcDump) to dump the LSASS process memory to access credentials.",
"mitreAttacks": [
{
"tactic": {
"id": "TA0003",
"name": "Persistence",
"techniques": [
{
"id": "T1078.002",
"name": "Domain Accounts"
},
{
"id": "T1078.003",
"name": "Local Accounts"
}
]
}
},
{
"tactic": {
"id": "TA0004",
"name": "Privilege Escalation",
"techniques": [
{
"id": "T1078.002",
"name": "Domain Accounts"
},
{
"id": "T1078.003",
"name": "Local Accounts"
}
]
}
},
{
"tactic": {
"id": "TA0005",
"name": "Defense Evasion",
"techniques": [
{
"id": "T1078.002",
"name": "Domain Accounts"
},
{
"id": "T1078.003",
"name": "Local Accounts"
}
]
}
},
{
"tactic": {
"id": "TA0006",
"name": "Credential Access",
"techniques": [
{
"id": "T1003",
"name": "OS Credential Dumping"
},
{
"id": "T1003.001",
"name": "LSASS Memory"
},
{
"id": "T1558",
"name": "Steal or Forge Kerberos Tickets"
}
]
}
}
],
"type": "Threat"
},
{
"severity": 9,
"count": 2,
"detectionRule": "WIN-CRD-PRC-COMSVCS-MINIDUMP-2",
"sensor": {
"id": "SophosSensorID",
"type": "endpoint",
"source": "Sophos",
"version": "1.24.1.1"
},
"device": {
"id": "8028601a-c171-4114-8b19-b27df55ee8c8",
"type": "server",
"entity": "EC2AMAZ-HKOG4LG"
},
"time": "2025-03-18T22:06:50.259Z",
"detectionRuleDescription": "The MiniDumpW function of comsvcs.dll can be used to dump process memory, including lsass.exe. The function requires the PID of lsass.exe. In addition, the MiniDumpW function can be called using #24 or even the negative number representation #-4294967272 rather than its name. \n",
"mitreAttacks": [
{
"tactic": {
"id": "TA0003",
"name": "Persistence",
"techniques": [
{
"id": "T1078.002",
"name": "Domain Accounts"
},
{
"id": "T1078.003",
"name": "Local Accounts"
}
]
}
},
{
"tactic": {
"id": "TA0004",
"name": "Privilege Escalation",
"techniques": [
{
"id": "T1078.002",
"name": "Domain Accounts"
},
{
"id": "T1078.003",
"name": "Local Accounts"
}
]
}
},
{
"tactic": {
"id": "TA0005",
"name": "Defense Evasion",
"techniques": [
{
"id": "T1078.002",
"name": "Domain Accounts"
},
{
"id": "T1078.003",
"name": "Local Accounts"
}
]
}
},
{
"tactic": {
"id": "TA0006",
"name": "Credential Access",
"techniques": [
{
"id": "T1003",
"name": "OS Credential Dumping"
},
{
"id": "T1003.001",
"name": "LSASS Memory"
}
]
}
}
],
"type": "Threat"
}
],
"pages": {
"current": 1,
"size": 3,
"total": 28,
"items": 82,
"maxSize": 2000
}
}
Conclusion¶
For a comprehensive description of the detections API, see API reference.