Skip to content

Get alert details

GET/alerts/{alertId}

Common API · Alerts

Get details of a specific alert.

Required permissionalerts:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
alertId path string (uuid) Yes Alert ID.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/common/v1/alerts/<alertId>" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/common/v1/alerts/<alertId>",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/common/v1/alerts/<alertId>" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/common/v1/alerts/<alertId>", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/common/v1/alerts/<alertId>", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Details of the requested alert.

Response fields

idstring (uuid)required
Alert ID.
allowedActionsarray of string
Actions that you can perform on these alerts.
Each item must be one of: acknowledge, cleanPua, cleanVirus, authPua, clearThreat, clearHmpa, sendMsgPua, sendMsgThreat.
categorystring
Alert categories.
Must be one of: adSync, applicationControl, appReputation, azure, blockListed, connectivity, credentialManager, criticalAttackWarning, cswitch, cwg, denc, deviceAndPlatformHealth, dnsProtectionLocation, downloadReputation, endpointFirewall, fenc, forensicSnapshot, general, integrations, isolation, malware, mobiles, mtr, policy, protection, pua, runtimeDetections, security, smc, systemHealth, uav, uncategorized, updating, utm, virt, wireless, xgEmail, ztnaAuthentication, ztnaGateway, ztnaResource.
descriptionstring
Alert description.
groupKeystring
Alert group key.
managedAgentobject
Show child attributesHide child attributes
idstring (uuid)required
Alert source ID.
typestringrequired
Source that triggered the alert.
Must be one of: mobile, computer, server, securityVm, utm, accessPoint, wirelessNetwork, mailbox, slec, xgFirewall, ztnaGateway, sensor.
namestring
Name of alert source.
personobject
Reference to the associated person on the alert source.
Show child attributesHide child attributes
idstring (uuid)required
User ID.
namestring
User name.
productstring
Product types.
Must be one of: other, endpoint, server, mobile, encryption, emailGateway, webGateway, phishThreat, wireless, firewall, ztna, cswitch, secureWebservice.
raisedAtstring (datetime)
When the alert was triggered.
severitystring
Severity levels for alerts.
Must be one of: high, medium, low.
tenantobject
Show child attributesHide child attributes
idstring (uuid)required
Tenant ID for the alert.
namestringrequired
Tenant name.
dataRegionstring
The data region where tenant data is stored.
Must be one of: eu01, eu02, us01, us02, us03, ca01, au01, jp01, in01, br01, ae01.
typestring
Alert type.

Errors

Status Meaning
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "id": "a5ded91c-6575-435c-a6b4-64b94f9048ff",
  "allowedActions": [
    "acknowledge"
  ],
  "category": "updating",
  "description": "John-PC is out of date.",
  "groupKey": "MSxFdmVudDo6RW5kcG9pbnQ6Ok91dE9mRGF0ZSw1MTMs",
  "managedAgent": {
    "id": "bb90527d-73a8-4e6e-85c6-20c2e0c5bc6f",
    "type": "computer"
  },
  "person": {
    "id": "17dd896f-ee9f-4f7d-a2a2-6a8c0b48ff15"
  },
  "product": "endpoint",
  "raisedAt": "2021-02-12T15:04:53.780",
  "severity": "medium",
  "tenant": {
    "id": "79067fa3-e4d0-4769-a5f7-8d6550b3b68b",
    "name": "Acme Corp"
  },
  "type": "Event::Endpoint::OutOfDate",
  "lastCorrelatedAt": "2024-02-12T16:30:45.123Z",
  "updatedAt": "2024-02-12T16:30:45.123Z",
  "eventCount": 5,
  "status": "open"
}