Skip to content

Get group results

GET/queries/detection-groups/{runId}/results

Detections API · DetectionGroup

Return the results of the group query run with the given ID.

Required permissiondetections.queries.detections:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
runId path string (uuid) Yes Run ID of a query.
page query integer No The page number to fetch, starting with 1.
pageSize query integer No The size of the page requested.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/detections/v1/queries/detection-groups/<runId>/results" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/detections/v1/queries/detection-groups/<runId>/results",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/detections/v1/queries/detection-groups/<runId>/results" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/detections/v1/queries/detection-groups/<runId>/results", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/detections/v1/queries/detection-groups/<runId>/results", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Successful retrieval of a group results page.

Response fields

itemsarray of object
Page of group results.
Group of detections.
Show child attributesHide child attributes
idstring (uuid)
The group ID.
severityintegerrequired
Suspicion score of the detections in the group.
countintegerrequired
Number of events in the group.
detectionRulestringrequired
Detection rule ID.
sensorobjectrequired
The sensor which generated the detection.
Show child attributesHide child attributes
idstringrequired
ID of the sensor.
typestringrequired
Sensor type where detection occurred.
Must be one of: cloud, endpoint, email, firewall, iam, network, compound, backupAndRecovery.
sourcestringrequired
The name of the sensor source.
versionstringrequired
The version of the sensor provided by the vendor.
namestring
The name of the sensor.
deviceobject
Device associated with a detection.
Show child attributesHide child attributes
idstring (uuid)
ID of the device.
typestring
Device type where detection occurred.
Must be one of: computer, sensor, server.
entitystring
Entity of the device.
timestring (date-time)required
Creation time of the detections in the group.
detectionRuleDescriptionstring
Detection rule ID description.
mitreAttacksarray of objectrequired
List of MITRE ATT&CK objects associated with this detection group.
MITRE ATT&CK name and description.
Show child attributesHide child attributes
tacticobject
Tactic used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the tactic.
namestring
MITRE ATT&CK name.
techniquesarray of object
MITRE ATT&CK techniques.
Technique used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the technique.
namestring
Name of the technique.
typestringrequired
Type of the detections in the group.
pagesobject
Show child attributesHide child attributes
currentintegerrequired
The 1-based page number being returned.
sizeintegerrequired
The size of the page being returned.
totalinteger
(Optional) The total number of pages that exist, if pageTotal=true in the request.
itemsinteger
(Optional) The total number of items across all pages.
maxSizeintegerrequired
The maximum page size that can be requested.

Errors

Status Meaning
401 Unauthorized.
403 Forbidden.
404 Not found.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "items": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "severity": 0,
      "count": 0,
      "detectionRule": "string",
      "sensor": {
        "id": "SophosSensorID",
        "type": "cloud",
        "source": "Sophos",
        "version": "1.18.1",
        "name": "string"
      },
      "device": {
        "id": "0569f2b7-756c-4d16-8804-798a6d0030cf",
        "type": "computer",
        "entity": "EC2AMAZ-HKOG4LG"
      },
      "time": "2023-11-18T12:02:15.604Z",
      "detectionRuleDescription": "string",
      "mitreAttacks": [
        {
          "tactic": {
            "id": "TA0002",
            "name": "Execution",
            "techniques": [
              {
                "id": "T1059",
                "name": "Command and Scripting Interpreter"
              }
            ]
          }
        }
      ],
      "type": "Threat"
    }
  ],
  "pages": {
    "current": 0,
    "size": 0,
    "total": 0,
    "items": 0,
    "maxSize": 0
  }
}

See the guide for a narrative walkthrough of this API.