Policy Settings Object Schemas

This page documents JSON schema definitions for endpoint policy settings with values that are objects. See the JSON schema website for a primer on how to read these specification.

Schema for intrusionpreventionexclusion¶

object or

arrayOfObjects that use the schema

intrusionPreventionExclusion must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/intrusionPreventionExclusion.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "description": "Intrusion Prevention exclusion",
  "properties": {
    "localPorts": {
      "type": "array",
      "description": "Local allowed ports.",
      "items": {
        "type": "integer",
        "minimum": 1,
        "maximum": 65535
      }
    },
    "remotePorts": {
      "type": "array",
      "description": "Remote allowed ports.",
      "items": {
        "type": "integer",
        "minimum": 1,
        "maximum": 65535
      }
    },
    "direction": {
      "type": "string",
      "enum": [
        "inbound",
        "outbound",
        "both"
      ],
      "description": "Direction property of the intrusion prevention exclusion."
    },
    "remoteAddresses": {
      "description": "Remote addresses to exempt from Intrusion Prevention checks.",
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  },
  "required": [
    "direction"
  ]
}

Schema for isolationexclusion¶

object or

arrayOfObjects that use the schema

isolationExclusion must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/isolationExclusion.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "description": "Endpoint Isolation exclusion",
  "properties": {
    "localPorts": {
      "type": "array",
      "description": "Local allowed ports.",
      "items": {
        "type": "integer",
        "minimum": 1,
        "maximum": 65535
      }
    },
    "remotePorts": {
      "type": "array",
      "description": "Remote allowed ports.",
      "items": {
        "type": "integer",
        "minimum": 1,
        "maximum": 65535
      }
    },
    "direction": {
      "type": "string",
      "enum": [
        "inbound",
        "outbound",
        "both"
      ],
      "description": "IP traffic direction."
    },
    "remoteAddresses": {
      "description": "Remote addresses to exempt from isolation restrictions.",
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  },
  "required": [
    "direction"
  ]
}

Schema for scanningexclusion¶

object or

arrayOfObjects that use the schema

scanningExclusion must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/scanningExclusion.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "value": {
      "type": "string",
      "description": "Exclusion value."
    },
    "type": {
      "type": "string",
      "enum": [
        "path",
        "posixPath",
        "virtualPath",
        "process",
        "web",
        "pua",
        "detectedExploit",
        "amsi",
        "behavioral",
        "journalHashingProcess",
        "journalHashingPath"
      ],
      "description": "Scanning exclusion type. The type `virtualPath` is valid only in `server-threat-protection` policies."
    },
    "scanMode": {
      "type": "string",
      "description": "Default value of scan mode is `onDemandAndOnAccess` for exclusions of type `path`, `posixPath` and `virtualPath`, and `onAccess` for `process`, `web`, `pua`, and `amsi`. Exclusions of type `behavioral` and `detectedExploit` don't support a scan mode.",
      "enum": [
        "onDemand",
        "onAccess",
        "onDemandAndOnAccess"
      ]
    }
  },
  "required": [
    "value",
    "type"
  ]
}

Schema for edrexclusion¶

object or

arrayOfObjects that use the schema

edrExclusion must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/edrExclusion.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "description": "Exclusion for data collection and investigation policy.",
  "properties": {
    "value": {
      "type": "string",
      "description": "Exclusion value.",
      "maxLength": 260
    },
    "type": {
      "type": "string",
      "enum": [
        "path",
        "process"
      ],
      "description": "Exclusion type."
    }
  },
  "required": [
    "value",
    "type"
  ]
}

Schema for fileintegritymonitoringlocation¶

object or

arrayOfObjects that use the schema

fileIntegrityMonitoringLocation must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/fileIntegrityMonitoringLocation.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "description": "File Integrity Monitoring location to include or exclude.",
  "properties": {
    "type": {
      "type": "string",
      "description": "Location type.",
      "enum": [
        "file",
        "folder",
        "registryKey",
        "registryValue"
      ]
    },
    "path": {
      "type": "string",
      "description": "File, folder, registry key, or registry value. For example, file \"C:\\foo.exe\", folder \"C:\\foo\", and registry value \"HKEY_LOCAL_MACHINE\\Software\\Foo\"."
    },
    "extensions": {
      "type": "array",
      "items": "string",
      "description": "File extensions to monitor, for example, `[\"*.exe\", \"*.ini\"]`. Applies only when type is `folder` and location is included, not excluded.",
      "pattern": "^[*][.][a-z0-9]+$"
    },
    "recursive": {
      "type": "boolean",
      "description": "Include children. Applies only when `type` is `folder` or `registryKey`.",
      "default": false
    },
    "allFiles": {
      "type": "boolean",
      "description": "Include all files in folder. Applies only when location is included, not excluded.",
      "default": false
    },
    "monitor": {
      "type": "boolean",
      "description": "Monitor when location is included. Applies only when `type` is `folder`.",
      "default": false
    }
  },
  "required": [
    "type",
    "path"
  ]
}

Schema for peripheralcontrolexemption¶

object or

arrayOfObjects that use the schema

peripheralControlExemption must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/peripheralControlExemption.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "peripheralId": {
      "type": "string",
      "description": "Peripheral ID assigned by the system."
    },
    "action": {
      "type": "string",
      "description": "Action to take on the peripheral. `readOnly` applies only to peripherals that are floppy or optical drives, removable storage, and secure removable storage devices such as USB sticks. `blockBridged` only applies to wireless devices.",
      "value": [
        "allowed",
        "blocked",
        "readOnly",
        "blockBridged"
      ]
    },
    "enforceBy": {
      "type": "string",
      "description": "How to enforce the exemption: by peripheral model or by the ID of a specific detected instance.",
      "enum": [
        "id",
        "instance",
        "model"
      ]
    }
  },
  "required": [
    "peripheralId",
    "action",
    "enforceBy"
  ]
}

Schema for lockdownallowedfile¶

object or

arrayOfObjects that use the schema

lockdownAllowedFile must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/lockdownAllowedFile.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "description": "Lockdown allowed file rule.",
  "properties": {
    "path": {
      "type": "string",
      "description": "File path."
    },
    "onAllowList": {
      "type": "boolean",
      "description": "Apply rule only if the folder is on the allow list.",
      "default": false
    },
    "sha1": {
      "type": "string",
      "description": "File SHA1 checksum."
    },
    "size": {
      "type": "integer",
      "description": "File size."
    },
    "comment": {
      "type": "string",
      "description": "Comment for the rule."
    }
  }
}

Schema for lockdownblockedfile¶

object or

arrayOfObjects that use the schema

lockdownBlockedFile must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/lockdownBlockedFile.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "description": "Lockdown blocked or excluded file rule.",
  "properties": {
    "path": {
      "type": "string",
      "description": "File path."
    },
    "sha1": {
      "type": "string",
      "description": "File SHA1 checksum."
    },
    "size": {
      "type": "integer",
      "description": "File size."
    },
    "comment": {
      "type": "string",
      "description": "Comment for the rule."
    }
  }
}

Schema for lockdownallowedfolder¶

object or

arrayOfObjects that use the schema

lockdownAllowedFolder must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/lockdownAllowedFolder.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "description": "Lockdown allowed folder rule.",
  "properties": {
    "path": {
      "type": "string",
      "description": "Folder path."
    },
    "onAllowList": {
      "type": "boolean",
      "description": "Apply rule only if the folder is on the allow list.",
      "default": false
    },
    "comment": {
      "type": "string",
      "description": "Comment for the rule."
    }
  }
}

Schema for lockdownblockedfolder¶

object or

arrayOfObjects that use the schema

lockdownBlockedFolder must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/lockdownBlockedFolder.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "description": "Lockdown blocked folder rule.",
  "properties": {
    "path": {
      "type": "string",
      "description": "Folder path."
    },
    "comment": {
      "type": "string",
      "description": "Comment for the rule."
    }
  }
}

Schema for lockdownexcludedfolder¶

object or

arrayOfObjects that use the schema

lockdownExcludedFolder must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/lockdownExcludedFolder.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "description": "Lockdown excluded folder rule.",
  "properties": {
    "path": {
      "type": "string",
      "description": "Folder path."
    },
    "comment": {
      "type": "string",
      "description": "Comment for the rule."
    }
  }
}

Schema for webcontrolschedule¶

object or

arrayOfObjects that use the schema

webControlSchedule must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/webControlSchedule.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "description": "Schedule specifying a time-range in a 24 hour period and days of the week.",
  "properties": {
    "from": {
      "type": "string",
      "description": "Time in `HH:MM` format.",
      "pattern": "^[0-2][0-9]:[0-5][0-9]$"
    },
    "to": {
      "type": "string",
      "description": "Time in `HH:MM` format.",
      "pattern": "^[0-2][0-9]:[0-5][0-9]$"
    },
    "days": {
      "type": "array",
      "description": "Weekdays when the schedule is active.",
      "items": {
        "type": "string",
        "enum": [
          "sunday",
          "monday",
          "tuesday",
          "wednesday",
          "thursday",
          "friday",
          "saturday"
        ]
      }
    }
  },
  "required": [
    "from",
    "to",
    "days"
  ]
}

Schema for webcontrollocalsitetagaction¶

object or

arrayOfObjects that use the schema

webControlLocalSiteTagAction must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/webControlLocalSiteTagAction.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "description": "Actions to take on websites tagged with certain local sites tags.",
  "properties": {
    "tag": {
      "type": "string",
      "description": "Tag name."
    },
    "action": {
      "type": "string",
      "description": "Action to take against a tagged website.",
      "enum": [
        "allow",
        "block",
        "warn"
      ]
    }
  }
}

Schema for webcontrolwebprofilesschedule¶

object or

arrayOfObjects that use the schema

webControlWebProfilesSchedule must contain JSON objects that conform to the following schema:

{
  "$id": "https://api.central.sophos.com/schemas/endpoint/policy-settings/webControlWebProfilesSchedule.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "description": "Web profiles schedule specifying a time-range in a 24 hour period and days of the week.",
  "properties": {
    "from": {
      "type": "string",
      "description": "Time in `HH:MM` format.",
      "pattern": "^([01][0-9]|2[0-3]):[0-5][0-9]$"
    },
    "to": {
      "type": "string",
      "description": "Time in `HH:MM` format.",
      "pattern": "^([01][0-9]|2[0-3]):[0-5][0-9]$"
    },
    "days": {
      "type": "array",
      "description": "Weekdays when the schedule is active.",
      "items": {
        "type": "string",
        "enum": [
          "sunday",
          "monday",
          "tuesday",
          "wednesday",
          "thursday",
          "friday",
          "saturday"
        ]
      }
    },
    "webProfileId": {
      "type": "string",
      "description": "Web profile ID."
    },
    "priority": {
      "type": "integer",
      "description": "Priority of the web profile schedule. Higher numbers indicate higher priority."
    }
  },
  "required": [
    "from",
    "to",
    "days",
    "webProfileId",
    "priority"
  ]
}