Skip to content

Get detection result

GET/queries/detections/{runId}/results

Detections API · Detections

Return the results of the detections query run with the given ID.

Required permissiondetections.queries.detections:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
runId path string (uuid) Yes Run ID of a query.
page query integer No The page number to fetch, starting with 1.
pageSize query integer No The size of the page requested.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/<runId>/results" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/<runId>/results",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/<runId>/results" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/<runId>/results", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/<runId>/results", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Successful retrieval of a detections results page.

Response fields

itemsarray of object
Page of detection results.
The detection item.
Show child attributesHide child attributes
idstringrequired
The Detection ID.
Must match the pattern ^[A-Fa-f0-9_-]+$. Must be at most 150 characters long.
attackTypestring
The attack type of the detection.
caseDescriptionobject
Description of case handler verdict.
Show child attributesHide child attributes
correlatedReasonIdstring
ID of the correlation reason used for associating the case with the detection.
createdReasonIdstring
ID of the reason for creating this case handler verdict.
detectionDescriptionobject
Description of detection handler verdict.
Show child attributesHide child attributes
createdReasonIdstring
ID of the reason for creating this detection handler verdict.
significanceIdstring
ID of the significance of associated handler verdict.
detectionRulestringrequired
Detection Rule ID.
sensorGeneratedAtstring (date-time)
Time when the event was created by the sensor.
sensorobjectrequired
The sensor which generated the detection.
Show child attributesHide child attributes
idstringrequired
ID of the sensor.
typestringrequired
Sensor type where detection occurred.
Must be one of: cloud, endpoint, email, firewall, iam, network, compound, backupAndRecovery.
sourcestringrequired
The name of the sensor source.
versionstringrequired
The version of the sensor provided by the vendor.
namestring
The name of the sensor.
deviceobjectrequired
Device associated with a detection.
Show child attributesHide child attributes
idstring (uuid)
ID of the device.
typestring
Device type where detection occurred.
Must be one of: computer, sensor, server.
entitystring
Entity of the device.
detectionSigmaobject
Information about the detection method.
detectionEqlstring
EQL instructions for performing the classification.
detectionAttackstringrequired
MITRE ATT&CK tactic category of the detection.
detectionLicensesstring
Licenses required for the rule or process.
geolocationarray of object
List of geolocation of sensors associated with the detection.
Geolocation of the sensor.
Show child attributesHide child attributes
fieldNamestring
Name of the IP.
fieldValuestring
Value of the IP.
citystring
City where the device is located.
statestring
State where the device is located.
countrystring
Country where the device is located.
countryCodestring
Country code where the device is located, in ISO 3166-1 format.
postalstring
Postal code where the device is located.
latitudenumber
Latitude of device location.
longitudenumber
Longitude of device location.
entitiesarray of object
List of impacted and observed entities associated with the detection.
Detection entity.
Show child attributesHide child attributes
idstringrequired
Entity ID.
typestringrequired
Entity type. Possible values are user, device, ipAddress, networkFlow, file, process.
namestring
Entity name.
categorystringrequired
Entity Category.
Must be one of: impacted, observed.
attributesobject
Entity attributes.
intelixFileReputationarray of object
List of Intelix file reputation objects associated with this detection.
Intelix file reputation of detection.
Show child attributesHide child attributes
fieldNamestring
Name of the file.
fieldValuestring
Value of the file.
reputationScoreinteger
Reputation score of the file.
Must be ≥ 0 and ≤ 100.
detectionNamestring
Name of the detection.
mitreAttacksarray of objectrequired
List of MITRE ATT&CK objects associated with this detection.
MITRE ATT&CK name and description.
Show child attributesHide child attributes
tacticobject
Tactic used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the tactic.
namestring
MITRE ATT&CK name.
techniquesarray of object
MITRE ATT&CK techniques.
Technique used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the technique.
namestring
Name of the technique.
processedDatastring
Processed data for the detection.
rawDataobjectrequired
Raw data received from the source.
ruleDescriptionstring
A description of the rule that produced the detection.
severityintegerrequired
Severity of the detection. A higher score implies a more severe detection.
Must be ≥ 1 and ≤ 10.
schemastring
Describes the schema for the detection.
suppressedstring
Indicates whether a detection is marked as suppressed.
timestring (date-time)required
Creation time of the detection.
typestringrequired
Type of the detection.
pagesobject
Show child attributesHide child attributes
currentintegerrequired
The 1-based page number being returned.
sizeintegerrequired
The size of the page being returned.
totalinteger
(Optional) The total number of pages that exist, if pageTotal=true in the request.
itemsinteger
(Optional) The total number of items across all pages.
maxSizeintegerrequired
The maximum page size that can be requested.

Errors

Status Meaning
400 Bad request.
401 Unauthorized.
403 Forbidden.
404 Not found.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "items": [
    {
      "id": "string",
      "attackType": "Security Event Service Detections",
      "caseDescription": {
        "correlatedReasonId": "XDR-fortinet-fortianalyzer-Application-Layer-Protocol",
        "createdReasonId": "XDR-fortinet-fortianalyzer-Application-Layer-Protocol"
      },
      "detectionDescription": {
        "createdReasonId": "XDR-fortinet-fortianalyzer-Application-Layer-Protocol",
        "significanceId": "XDR-fortinet-fortianalyzer-Application-Layer-Protocol"
      },
      "detectionRule": "WIN-PER-PSH-ADD-SERVICE-REG-1",
      "sensorGeneratedAt": "2023-11-18T12:01:21Z",
      "sensor": {
        "id": "SophosSensorID",
        "type": "cloud",
        "source": "Sophos",
        "version": "1.18.1",
        "name": "string"
      },
      "device": {
        "id": "0569f2b7-756c-4d16-8804-798a6d0030cf",
        "type": "computer",
        "entity": "EC2AMAZ-HKOG4LG"
      },
      "detectionSigma": {},
      "detectionEql": "string",
      "detectionAttack": "Defense Evasion",
      "detectionLicenses": "string",
      "geolocation": [
        {
          "fieldName": "raw.meta_public_ip",
          "fieldValue": "52.11.152.156",
          "city": "Boardman",
          "state": "Oregon",
          "country": "United States",
          "countryCode": "US",
          "postal": "97818",
          "latitude": 45.8234,
          "longitude": -119.7257
        }
      ],
      "entities": [
        {
          "id": "string",
          "type": "string",
          "name": "string",
          "category": "impacted",
          "attributes": {}
        }
      ],
      "intelixFileReputation": [
        {
          "fieldName": "raw.sha256",
          "fieldValue": "de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c",
          "reputationScore": 95,
          "detectionName": "WIN-EXE-DM-SUS-POWERSHELL-SCRIPT-BLOCK-1"
        }
      ],
      "mitreAttacks": [
        {
          "tactic": {
            "id": "TA0002",
            "name": "Execution",
            "techniques": [
              {
                "id": "T1059",
                "name": "Command and Scripting Interpreter"
              }
            ]
          }
        }
      ],
      "processedData": "The process 'C:\\Windows\\System32\\svchost.exe' was created by 'C:\\Windows\\System32\\services.exe'.",
      "rawData": {},
      "ruleDescription": "string",
      "severity": 5,
      "schema": "string",
      "suppressed": "string",
      "time": "2023-11-18T12:02:15.604Z",
      "type": "Threat"
    }
  ],
  "pages": {
    "current": 0,
    "size": 0,
    "total": 0,
    "items": 0,
    "maxSize": 0
  }
}

See the guide for a narrative walkthrough of this API.