Skip to content

Get a impacted entities

GET/cases/{caseId}/impacted-entities

Cases API · Cases

Get impacted entities for an XDR case.

Required permissionxdr-cases.case.impacted-entities:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
caseId path string Yes Case ID. The ID follows the pattern ^[A-Za-z0-9]+-[A-Za-z0-9]+$.
page query integer No The page number to fetch, starting with 1.
pageSize query integer No The size of the page requested.
sort query string No Sort column ex. sort=“type:asc” sort=“type:desc" sort=“type”.
id query string No Exact match search for entity ID.
name query string No Exact match search for entity name.
type query string No Exact match search for entity type.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/impacted-entities" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/impacted-entities",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/impacted-entities" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/impacted-entities", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/impacted-entities", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Impacted Entities.

Response fields

itemsarray of object
Impacted entity.
Show child attributesHide child attributes
idstringrequired
Entity ID.
namestringrequired
Entity name.
typestringrequired
Entity type.
Must be one of: user, device, ipAddress, networkFlow, file, process.
detectionsarray of object
Associated detections.
Detection reference.
Show child attributesHide child attributes
idstringrequired
Detection ID.
Must match the pattern ^[a-f0-9_-]+$. Must be at most 150 characters long.
detectionRulestring
Detection rule ID.
entityAttributesobject
Entity attributes.
pagesobject
Show child attributesHide child attributes
currentintegerrequired
The 1-based page number being returned.
sizeintegerrequired
The size of the page being returned.
totalinteger
(Optional) The total number of pages that exist, if pageTotal=true in the request.
itemsinteger
(Optional) The total number of items across all pages.
maxSizeintegerrequired
The maximum page size that can be requested.

Errors

Status Meaning
400 Bad request.
401 Unauthorized.
403 Forbidden.
404 Not found.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "items": [
    {
      "id": "string",
      "name": "string",
      "type": "user",
      "detections": [
        {
          "id": "2e0cdd5ffec_3bad8fb8f",
          "detectionRule": "WIN-PER-PSH-ADD-SERVICE-REG-1"
        }
      ],
      "entityAttributes": {}
    }
  ],
  "pages": {
    "current": 0,
    "size": 0,
    "total": 0,
    "items": 0,
    "maxSize": 0
  }
}

See the guide for a narrative walkthrough of this API.