Skip to content

Get a single detection

GET/cases/{caseId}/detections/{detectionId}

Cases API · Cases

Get a detection associated with case.

Required permissionxdr-cases.case.detection:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
caseId path string Yes Case ID. The ID follows the pattern ^[A-Za-z0-9]+-[A-Za-z0-9]+$.
detectionId path string Yes Detection ID.
Must match the pattern ^[a-f0-9_-]+$. Must be at most 150 characters long.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/detections/<detectionId>" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/detections/<detectionId>",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/detections/<detectionId>" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/detections/<detectionId>", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/detections/<detectionId>", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Requested case detection.

Response fields

idstringrequired
Detection ID.
Must match the pattern ^[a-f0-9_-]+$. Must be at most 150 characters long.
attackTypestring
The attack type of the detection.
detectionRulestringrequired
Detection rule ID.
sensorGeneratedAtstring (date-time)
Time when the event was created by the sensor.
sensorobjectrequired
The sensor which generated the detection.
Show child attributesHide child attributes
idstringrequired
ID of the sensor.
typestringrequired
Sensor type where detection occurred.
Must be one of: cloud, endpoint, email, firewall, iam, network, compound, backupAndRecovery.
sourcestringrequired
The name of the sensor source.
versionstringrequired
The version of the sensor provided by the vendor.
namestring
The name of the sensor.
deviceobjectrequired
Device associated with a detection.
Show child attributesHide child attributes
idstring (uuid)
ID of the device.
typestring
Device type where detection occurred.
Must be one of: computer, sensor, server.
entitystring
Entity of the device.
detectionSigmaobject
Information about the detection method.
detectionEqlstring
EQL instructions for performing the classification.
detectionAttackstringrequired
MITRE ATT&CK tactic category of the detection.
detectionLicensesstring
Licenses required for the rule or process.
geolocationarray of object
List of geolocation of sensors associated with the detection.
Geolocation of the sensor.
Show child attributesHide child attributes
fieldNamestring
Name of the IP.
fieldValuestring
Value of the IP.
citystring
City where the device is located.
statestring
State where the device is located.
countrystring
Country where the device is located.
countryCodestring
Country code where the device is located, in ISO 3166-1 format.
postalstring
Postal code where the device is located.
latitudenumber
Latitude of device location.
longitudenumber
Longitude of device location.
intelixFileReputationarray of object
List of Intelix file reputation objects associated with this detection.
Intelix file reputation of detection.
Show child attributesHide child attributes
fieldNamestring
Name of the file.
fieldValuestring
Value of the file.
reputationScoreinteger
Reputation score of the file.
Must be ≥ 0 and ≤ 100.
detectionNamestring
Name of the detection.
mitreAttacksarray of objectrequired
List of MITRE ATT&CK objects associated with this detection.
MITRE ATT&CK name and description.
Show child attributesHide child attributes
tacticobject
Tactic used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the tactic.
namestring
MITRE ATT&CK name.
techniquesarray of object
MITRE ATT&CK techniques.
Technique used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the technique.
namestring
Name of the technique.
rawDataobjectrequired
Raw data received from the source.
ruleDescriptionstring
A description of the rule that produced the detection.
severityintegerrequired
Severity of the detection. A higher score implies a more severe detection.
Must be ≥ 1 and ≤ 10.
schemastring
Describes the schema for the detection.
timestring (date-time)required
Creation time of the detection.
typestringrequired
Type of the detection.

Errors

Status Meaning
400 Bad request.
401 Unauthorized.
403 Forbidden.
404 Not found.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "id": "2e0cdd5ffec_3bad8fb8f",
  "attackType": "Security Event Service Detections",
  "detectionRule": "WIN-PER-PSH-ADD-SERVICE-REG-1",
  "sensorGeneratedAt": "2023-11-18T12:01:21Z",
  "sensor": {
    "id": "SophosSensorID",
    "type": "cloud",
    "source": "Sophos",
    "version": "1.18.1",
    "name": "string"
  },
  "device": {
    "id": "0569f2b7-756c-4d16-8804-798a6d0030cf",
    "type": "computer",
    "entity": "EC2AMAZ-HKOG4LG"
  },
  "detectionSigma": {},
  "detectionEql": "string",
  "detectionAttack": "Defense Evasion",
  "detectionLicenses": "string",
  "geolocation": [
    {
      "fieldName": "raw.meta_public_ip",
      "fieldValue": "52.11.152.156",
      "city": "Boardman",
      "state": "Oregon",
      "country": "United States",
      "countryCode": "US",
      "postal": "97818",
      "latitude": 45.8234,
      "longitude": -119.7257
    }
  ],
  "intelixFileReputation": [
    {
      "fieldName": "raw.sha256",
      "fieldValue": "de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c",
      "reputationScore": 95,
      "detectionName": "WIN-EXE-DM-SUS-POWERSHELL-SCRIPT-BLOCK-1"
    }
  ],
  "mitreAttacks": [
    {
      "tactic": {
        "id": "TA0002",
        "name": "Execution",
        "techniques": [
          {
            "id": "T1059",
            "name": "Command and Scripting Interpreter"
          }
        ]
      }
    }
  ],
  "rawData": {},
  "ruleDescription": "string",
  "severity": 5,
  "schema": "string",
  "time": "2023-11-18T12:02:15.604Z",
  "type": "Threat"
}

See the guide for a narrative walkthrough of this API.