Skip to content

Get case detections

GET/cases/{caseId}/detections

Cases API · Cases

Get all case detections.

Required permissionxdr-cases.case.detection:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
caseId path string Yes Case ID. The ID follows the pattern ^[A-Za-z0-9]+-[A-Za-z0-9]+$.
page query integer No The page number to fetch, starting with 1.
pageSize query integer No The size of the page requested.
sort query string No Sort column ex. sort=“type:asc” sort=“type:desc" sort=“type”.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/detections" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/detections",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/detections" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/detections", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/detections", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Case detections.

Response fields

itemsarray of object
The detection item.
Show child attributesHide child attributes
idstringrequired
Detection ID.
Must match the pattern ^[a-f0-9_-]+$. Must be at most 150 characters long.
attackTypestring
The attack type of the detection.
detectionRulestringrequired
Detection rule ID.
sensorGeneratedAtstring (date-time)
Time when the event was created by the sensor.
sensorobjectrequired
The sensor which generated the detection.
Show child attributesHide child attributes
idstringrequired
ID of the sensor.
typestringrequired
Sensor type where detection occurred.
Must be one of: cloud, endpoint, email, firewall, iam, network, compound, backupAndRecovery.
sourcestringrequired
The name of the sensor source.
versionstringrequired
The version of the sensor provided by the vendor.
namestring
The name of the sensor.
deviceobjectrequired
Device associated with a detection.
Show child attributesHide child attributes
idstring (uuid)
ID of the device.
typestring
Device type where detection occurred.
Must be one of: computer, sensor, server.
entitystring
Entity of the device.
detectionSigmaobject
Information about the detection method.
detectionEqlstring
EQL instructions for performing the classification.
detectionAttackstringrequired
MITRE ATT&CK tactic category of the detection.
detectionLicensesstring
Licenses required for the rule or process.
geolocationarray of object
List of geolocation of sensors associated with the detection.
Geolocation of the sensor.
Show child attributesHide child attributes
fieldNamestring
Name of the IP.
fieldValuestring
Value of the IP.
citystring
City where the device is located.
statestring
State where the device is located.
countrystring
Country where the device is located.
countryCodestring
Country code where the device is located, in ISO 3166-1 format.
postalstring
Postal code where the device is located.
latitudenumber
Latitude of device location.
longitudenumber
Longitude of device location.
intelixFileReputationarray of object
List of Intelix file reputation objects associated with this detection.
Intelix file reputation of detection.
Show child attributesHide child attributes
fieldNamestring
Name of the file.
fieldValuestring
Value of the file.
reputationScoreinteger
Reputation score of the file.
Must be ≥ 0 and ≤ 100.
detectionNamestring
Name of the detection.
mitreAttacksarray of objectrequired
List of MITRE ATT&CK objects associated with this detection.
MITRE ATT&CK name and description.
Show child attributesHide child attributes
tacticobject
Tactic used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the tactic.
namestring
MITRE ATT&CK name.
techniquesarray of object
MITRE ATT&CK techniques.
Technique used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the technique.
namestring
Name of the technique.
rawDataobjectrequired
Raw data received from the source.
ruleDescriptionstring
A description of the rule that produced the detection.
severityintegerrequired
Severity of the detection. A higher score implies a more severe detection.
Must be ≥ 1 and ≤ 10.
schemastring
Describes the schema for the detection.
timestring (date-time)required
Creation time of the detection.
typestringrequired
Type of the detection.
pagesobject
Show child attributesHide child attributes
currentintegerrequired
The 1-based page number being returned.
sizeintegerrequired
The size of the page being returned.
totalinteger
(Optional) The total number of pages that exist, if pageTotal=true in the request.
itemsinteger
(Optional) The total number of items across all pages.
maxSizeintegerrequired
The maximum page size that can be requested.

Errors

Status Meaning
400 Bad request.
401 Unauthorized.
403 Forbidden.
404 Not found.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "items": [
    {
      "id": "2e0cdd5ffec_3bad8fb8f",
      "attackType": "Security Event Service Detections",
      "detectionRule": "WIN-PER-PSH-ADD-SERVICE-REG-1",
      "sensorGeneratedAt": "2023-11-18T12:01:21Z",
      "sensor": {
        "id": "SophosSensorID",
        "type": "cloud",
        "source": "Sophos",
        "version": "1.18.1",
        "name": "string"
      },
      "device": {
        "id": "0569f2b7-756c-4d16-8804-798a6d0030cf",
        "type": "computer",
        "entity": "EC2AMAZ-HKOG4LG"
      },
      "detectionSigma": {},
      "detectionEql": "string",
      "detectionAttack": "Defense Evasion",
      "detectionLicenses": "string",
      "geolocation": [
        {
          "fieldName": "raw.meta_public_ip",
          "fieldValue": "52.11.152.156",
          "city": "Boardman",
          "state": "Oregon",
          "country": "United States",
          "countryCode": "US",
          "postal": "97818",
          "latitude": 45.8234,
          "longitude": -119.7257
        }
      ],
      "intelixFileReputation": [
        {
          "fieldName": "raw.sha256",
          "fieldValue": "de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c",
          "reputationScore": 95,
          "detectionName": "WIN-EXE-DM-SUS-POWERSHELL-SCRIPT-BLOCK-1"
        }
      ],
      "mitreAttacks": [
        {
          "tactic": {
            "id": "TA0002",
            "name": "Execution",
            "techniques": [
              {
                "id": "T1059",
                "name": "Command and Scripting Interpreter"
              }
            ]
          }
        }
      ],
      "rawData": {},
      "ruleDescription": "string",
      "severity": 5,
      "schema": "string",
      "time": "2023-11-18T12:02:15.604Z",
      "type": "Threat"
    }
  ],
  "pages": {
    "current": 0,
    "size": 0,
    "total": 0,
    "items": 0,
    "maxSize": 0
  }
}

See the guide for a narrative walkthrough of this API.