Skip to content

Get status

GET/endpoints/{endpointId}/forensic-logs/{forensicLogRequestId}

Endpoint API · Forensic Logs

Gets the status of the forensic log collection.

Required permissionendpoint-diagnose:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
endpointId path string (uuid) Yes Endpoint ID.
forensicLogRequestId path string (uuid) Yes ID of the forensic log collection request.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/forensic-logs/<forensicLogRequestId>" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/forensic-logs/<forensicLogRequestId>",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/forensic-logs/<forensicLogRequestId>" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/forensic-logs/<forensicLogRequestId>", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/forensic-logs/<forensicLogRequestId>", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Forensic log collection status.

Response fields

idstring (uuid)required
Identifies a request to collect forensic log from the endpoint.
statusstringrequired
Status of an endpoint file collection.
Must be one of: pending, finished, expired, failed.
receivedAtstring (date-time)required
Timestamp at which the action was received.
expiresAtstring (date-time)required
Timestamp from when to ignore the action on the endpoint.
errorMessagestring
Why the action failed.
forensicLogFileobject
Details of the file uploaded by an endpoint.
Show child attributesHide child attributes
fileNamestringrequired
Name of the file.
sha256stringrequired
SHA-256 hash of the file.
sizeintegerrequired
Size of the file in bytes.

Errors

Status Meaning
400 Bad request.
404 Can't find endpoint or forensic log request for the provided ID.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "id": "fda552f8-a411-4663-b11b-4aa8284c77ef",
  "status": "finished",
  "receivedAt": "2021-01-30T08:30:00.000Z",
  "expiresAt": "2021-02-04T08:30:00.000Z",
  "forensicLogFile": {
    "fileName": "forensic_sdu_b7e5f3aa-a7c6-43c6-a65e-3cd52008464b_62f01fb7-3dcb-40a7-9bab-1af32d5203e9.zip",
    "sha256": "99ff984dd6738eb99f2feaff54d0e93a8e820d8e3d817541960f7a88be628409",
    "size": 12345
  }
}

See the guide for a narrative walkthrough of this API.