Skip to content

Add application

POST/settings/exploit-mitigation/applications

Endpoint API · Exploit Mitigation

Exclude a set of file paths from Exploit Mitigation.

Required permissionendpoint-state:update

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.

Request body

Content type: application/json

Request body fields

pathsarray of stringrequired
Array of absolute paths to an application file to exclude. You may use HitmanPro.Alert expansion variables (For example, $desktop, $programfiles). Currently, this array may contain only one application path.
Must contain exactly 1 item. Each item must be 1–260 characters long.

Request samples

curl -X POST "https://api-<data-region>.central.sophos.com/endpoint/v1/settings/exploit-mitigation/applications" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"paths\": [
    \"\$programfiles\\\\FooApp\\\\foo.exe\"
  ]
}"


import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/endpoint/v1/settings/exploit-mitigation/applications",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={'paths': ['$programfiles\\FooApp\\foo.exe']},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "paths": [
    "$programfiles\\FooApp\\foo.exe"
  ]
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/endpoint/v1/settings/exploit-mitigation/applications" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/endpoint/v1/settings/exploit-mitigation/applications", strings.NewReader(`{
  "paths": [
    "$programfiles\\FooApp\\foo.exe"
  ]
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/endpoint/v1/settings/exploit-mitigation/applications", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "paths": [
    "$programfiles\\FooApp\\foo.exe"
  ]
}),
});
const data = await response.json();
console.log(data);

Responses

201 — Custom Exploit Mitigation application created.

Response fields

idstring (uuid)required
ID of an Exploit Mitigation application.
namestringrequired
Name of this Exploit Mitigation application.
Must be 1–1000 characters long.
pathsarray of stringrequired
Paths included in this Exploit Mitigation application.
Must contain at most 100 items. Each item must be 1–260 characters long.
categorystringrequired
Exploit Mitigation category ID.
Must be one of: browsers, exclude, java, media, office, plugins, test, other.
typestringrequired
Whether the application was detected by the system or added by the user.
Must be one of: detected, custom.
modificationsobject
Modifications made to the detected Exploit Mitigation Application. This object does not apply to when type is custom.
Show child attributesHide child attributes
protectedbooleanrequired
Whether or not this Exploit Mitigation Application is protected.
settingsobject

Errors

Status Meaning
409 Custom Exploit Mitigation application already exists.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

201

{
  "id": "00000000-0000-0000-0000-000000000000",
  "name": "string",
  "paths": [
    "string"
  ],
  "category": "browsers",
  "type": "detected",
  "modifications": {
    "protected": true,
    "settings": {
      "ASLR": true,
      "BannedAPI": true,
      "BottomUpASLR": true,
      "Caller": true,
      "DEP": true,
      "DeviceAndIoControl": true,
      "HeapSpray": true,
      "IAF": true,
      "Intruder": true,
      "KbdGuard": false,
      "LoadLib": true,
      "LockdownAutorun": true,
      "LockdownLoadImage": false,
      "LockdownNewFile": false,
      "NullPage": true,
      "PreventEtwTampering": true,
      "SEHOP": true,
      "StackExec": true,
      "StackPivot": true
    }
  }
}

See the guide for a narrative walkthrough of this API.