Live Discover API¶
Run osquery against endpoints connected to Sophos Fusion.
See the guide for a narrative walkthrough of this API.
Base URL¶
https://api-{dataRegion}.central.sophos.com/live-discover/v1 — Regional service in the production environment.
| Variable | Description | Default | Allowed values |
|---|---|---|---|
dataRegion | Data region where tenant data is stored. | eu01 | eu01, eu02, us01, us03, ca01, au01, jp01, in01, br01, ae01 |
Authentication¶
Every request carries an Authorization: Bearer header with an access token obtained through the client-credentials flow — see Get started.
Operations¶
Category¶
- List categories
GET/queries/categories - Get category
GET/queries/categories/{categoryId}
Live Discover¶
- Get enrichments
GET/enrichment-pivots - Create enrichment
POST/enrichment-pivots - Update enrichment
PATCH/enrichment-pivots/{enrichmentPivotId} - Delete enrichment
DELETE/enrichment-pivots/{enrichmentPivotId}
Query¶
- Get queries
GET/queries - Get query
GET/queries/{queryId}
Query Run¶
- List query runs
GET/queries/runs - Run query
POST/queries/runs - Get query run
GET/queries/runs/{runId} - Get endpoints
GET/queries/runs/{runId}/endpoints
Query Run Results¶
- Get results
GET/queries/runs/{runId}/results
Download¶