Skip to content

Get enrichments

GET/enrichment-pivots

Live Discover API · Live Discover

Get enrichments.

Required permissionlive-discover.query-catalog:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/live-discover/v1/enrichment-pivots" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/live-discover/v1/enrichment-pivots",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/live-discover/v1/enrichment-pivots" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/live-discover/v1/enrichment-pivots", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/live-discover/v1/enrichment-pivots", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Enrichments.

Response fields

itemsarray of objectrequired
Array of enrichments.
Enrichment.
Show child attributesHide child attributes
idstring (uuid)
Enrichment ID.
tenantobject
Tenant these resources belong to.
Show child attributesHide child attributes
idstring (uuid)required
namestring
sourceTypestring (enum)required
Enrichment source type.
Must be one of: canned, custom.
namestringrequired
Enrichment name.
descriptionstringrequired
Enrichment description.
typestring (enum)required
Enrichment type.
Must be one of: ipAddress, md5, sha256, dns, port, geolocation.
urlstringrequired
Enrichment URL.
createdAtstring (datetime)
When the enrichment was created.
createdByobject
Principal reference.
Show child attributesHide child attributes
idstring (uuid)required
Principal ID. This is the client ID for service principals.
typestring (enum)required
Principal type.
Must be one of: user, service.
namestring
Principal name. This doesn't apply to service principals.
accountTypestring
Account type.
Must be one of: partner, tenant, organization.
updatedAtstring (datetime)
When the enrichment was last updated.
updatedByobject
Principal reference.
Show child attributesHide child attributes
idstring (uuid)required
Principal ID. This is the client ID for service principals.
typestring (enum)required
Principal type.
Must be one of: user, service.
namestring
Principal name. This doesn't apply to service principals.
accountTypestring
Account type.
Must be one of: partner, tenant, organization.

Errors

Status Meaning
403 Forbidden.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "items": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "tenant": {
        "id": "00000000-0000-0000-0000-000000000000",
        "name": "string"
      },
      "sourceType": "canned",
      "name": "string",
      "description": "string",
      "type": "ipAddress",
      "url": "string",
      "createdAt": "string",
      "createdBy": {
        "id": "00000000-0000-0000-0000-000000000000",
        "type": "user",
        "name": "string",
        "accountType": "partner"
      },
      "updatedAt": "string",
      "updatedBy": {
        "id": "00000000-0000-0000-0000-000000000000",
        "type": "user",
        "name": "string",
        "accountType": "partner"
      }
    }
  ]
}

See the guide for a narrative walkthrough of this API.