SIEM Integration API¶

Pull Sophos Central events and alerts into a SIEM.

See the guide for a narrative walkthrough of this API.

Base URL¶

https://api-{dataRegion}.central.sophos.com/siem/v1 — Regional service in the production environment.

Authentication¶

Every request carries an Authorization: Bearer header with an access token obtained through the client-credentials flow — see Get started.

Operations¶

Alerts¶

Events¶

See Schema reference for more on Events.

Schemas¶

• IpsThreatData
• AlertEntity
• LegacyEventEntity

Download¶

• OpenAPI spec