Get detection counts¶

GET/queries/detections/counts

Get detection counts grouped by severity and type. If resolution, to, and from parameters aren't provided, resolution is set to day, to is set to current date, and from is set to 30 days from the current date and time. If from and to aren't provided, to is set to the current date and time. If resolution is day, hour, or minute, from is set to 30 days ago, 1 day ago, or 1 hour ago respectively. If from and to are provided, but resolution isn't, resolution is set based on internal calculation.

Required permissiondetections.queries.detections:read

Parameters¶

Name	In	Type	Required	Description
`X-Tenant-ID`	header	string (uuid)	Yes	Tenant ID.
`from`	query	string (date-time)	No	Start of time range for query.
`to`	query	string (date-time)	No	End of time range for query.
`resolution`	query	string	No	Time interval used for breakdown of detection counts. Must be one of: `day`, `hour`, `minute`.
`ids`	query	array of string	No	Filter detection count by the ID. Must contain 0–10 items. Items must be unique. Each item must match the pattern `^[A-Fa-f0-9_-]+$`. Each item must be at most 150 characters long.
`detectionRule`	query	string	No	Filter detection count by the detection rule ID. Must match the pattern `^[\p{L}0-9\s_-]*$`. Must be 0–300 characters long.
`severity`	query	array of integer	No	Filter detection count by the severity level. Each item must be ≥ 0 and ≤ 10.
`type`	query	array of string	No	Filter detection count by the type. Items must be unique. Each item must be one of: `process`, `threat`, `vulnerability`.
`category`	query	array of string	No	Filter detection count by the category. Items must be unique. Each item must be one of: `cloud`, `endpoint`, `email`, `firewall`, `iam`, `network`, `compound`, `backupAndRecovery`.
`source`	query	string	No	Filter detection count by the source. Must match the pattern `^[\p{L}0-9\s]*$`. Must be 0–200 characters long.
`deviceNameContains`	query	string	No	Filter detection count by the device name. Must match the pattern `^[\p{L}0-9\s_-]*$`. Must be 0–200 characters long.
`entityType`	query	string	No	Filter detection count by the entity type. Must match the pattern `^[\p{L}\s]*$`. Must be 0–200 characters long.
`location`	query	string	No	Case-insensitive text field that allows partial matching to filter detection count by location, City, State, and Country. Must match the pattern `^[\p{L}\s.-]*$`. Must be 0–200 characters long.
`mitreAttackTactics`	query	array of string	No	Filter detection count by the MITRE ATT&CK tactic name. Items must be unique. Each item must be one of: `collection`, `commandControl`, `credentialAccess`, `defenseEvasion`, `discovery`, `execution`, `exfiltration`, `impact`, `initialAccess`, `lateralMovement`, `persistence`, `privilegeEscalation`, `reconnaissance`, `resourceDevelopment`, `undefined`.
`mitreAttack`	query	string	No	Case-insensitive text field that allows partial matching to filter detection count by the MITRE ATT&CK technique ID, technique name, or tactic.
`operatingSystemName`	query	string	No	Case-insensitive text field that allows partial matching to filter detection count by operating system name. Must match the pattern `^[\p{L}0-9\s._-]*$`. Must be 0–200 characters long.
`operatingSystem`	query	array of string	No	Filter detection count by the operating system (exact match). Must contain 0–10 items. Items must be unique. Each item must match the pattern `^[\p{L}\s]*$`. Each item must be 0–100 characters long.
`username`	query	array of string	No	Filter detections by the username (exact match). Must contain 0–10 items. Items must be unique. Each item must match the pattern `^[\p{L}\s_-]*$`. Each item must be 0–300 characters long.
`showSuppressed`	query	boolean	No	Filter to count detections marked as suppressed.

Request samples¶

cURLPythonPowerShellGoJavaScript

curl -X GET "https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/counts" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"

import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/counts",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())

$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/counts" -Headers $headers

package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/counts", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}

const response = await fetch("https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/counts", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses¶

`200` — Successful retrieval of detection counts.¶

Response fields

fromstring (date-time)required

Start time of interval.

tostring (date-time)required

End time of interval.

tenantobjectrequired

Tenant information.

Show child attributesHide child attributes

idstring (uuid)

ID of the Tenant.

resolutionstringrequired

Time interval used for breakdown of detection counts.
Must be one of: day, hour, minute.

resolutionDetectionCountsarray of object

The total count of detections and counts categorized by severity and type within the specified interval.

Show child attributesHide child attributes

startsAtstring (date-time)required

Start time of the resolution interval.

endsAtstring (date-time)

End time of the resolution interval.

totalCountintegerrequired

Total number of detections in the resolution interval.

countBySeverityobject

Counts of detections, grouped by severity.

Show child attributesHide child attributes

infointegerrequired

Count of info severity detections.

lowintegerrequired

Count of low severity detections.

mediumintegerrequired

Count of medium severity detections.

highintegerrequired

Count of high severity detections.

criticalintegerrequired

Count of critical severity detections.

countByTypeobject

Counts of detections, grouped by type.

Show child attributesHide child attributes

processintegerrequired

Count of process type detections.

threatintegerrequired

Count of threat type detections.

vulnerabilityintegerrequired

Count of vulnerability type detections.

Errors¶

Status	Meaning
`400`	Bad Request.
`401`	Unauthorized.
`403`	Forbidden.
`500`	Unexpected error.

All error responses share the same shape — see the error response object.

Response examples¶

`200`¶

{
  "from": "2026-07-28T00:00:00Z",
  "to": "2026-07-28T00:00:00Z",
  "tenant": {
    "id": "4a9bb69a-c7f1-4a59-b912-7fe4ba70b751"
  },
  "resolution": "day",
  "resolutionDetectionCounts": [
    {
      "startsAt": "2026-07-28T00:00:00Z",
      "endsAt": "2026-07-28T00:00:00Z",
      "totalCount": 50,
      "countBySeverity": {
        "info": 10,
        "low": 7,
        "medium": 13,
        "high": 15,
        "critical": 5
      },
      "countByType": {
        "process": 24,
        "threat": 20,
        "vulnerability": 6
      }
    }
  ]
}

See the guide for a narrative walkthrough of this API.

Get detection counts¶

Parameters¶

Request samples¶

Responses¶

200 — Successful retrieval of detection counts.¶

Errors¶

Response examples¶

200¶

`200` — Successful retrieval of detection counts.¶

`200`¶