Skip to content

Get alerts

GET/alerts

SIEM Integration API · Alerts

Get alert with timestamps within last 24 hours.

Parameters

Name In Type Required Description
limit query integer No The maximum number of items to return, default is 200, max is 1000.
Must be ≥ 200 and ≤ 1000.
from_date query integer No The starting date from which alerts will be retrieved defined as Unix timestamp in UTC. Ignored if cursor is set. Must be within last 24 hours.
cursor query string No Identifier for next item in the list, this value is available in response as next_cursor. Response will default to last 24 hours if cursor is not within last 24 hours.
X-Tenant-ID header string Yes The tenant ID. Required when using Bearer Token based authentication.
from_date_offset_minutes query integer No Delay the data collection by X minutes from API.
Must be ≥ 0 and ≤ 1440.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/siem/v1/alerts" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/siem/v1/alerts",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/siem/v1/alerts" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/siem/v1/alerts", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/siem/v1/alerts", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Succeeded.

Response fields

has_moreboolean
itemsarray of object
This model wraps up an Alert. This contains various fields that contain information regarding the alert that was generated.
Show child attributesHide child attributes
created_atstring
The date at which the alert was created.
customer_idstring
The unique identifier of the customer linked with this record.
dataobject
descriptionstring
The description of the alert that was generated.
event_service_event_idstring
The Event Services event id.
idstring
Identifier for the alert.
infoobject
locationstring
The location captured for this record.
severitystring
The severity for this alert.
Must be one of: LOW, MEDIUM, HIGH.
sourcestring
Describes the source from alert was generated.
threatstring
The name of the threat responsible for the generation of alert.
threat_cleanableboolean
typestring
Describes the type of the device on which alert was generated.
whenstring
The date at which the alert was created.
next_cursorstring
Value of the next cursor. This will be used to make next call of API.

Errors

Status Meaning
400 Bad Request.
401 Authentication Failed.
403 Forbidden.
404 Not Found.
500 Internal Server Error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "has_more": true,
  "items": [
    {
      "created_at": "string",
      "customer_id": "string",
      "data": {},
      "description": "string",
      "event_service_event_id": "string",
      "id": "string",
      "info": {},
      "location": "string",
      "severity": "LOW",
      "source": "string",
      "threat": "string",
      "threat_cleanable": true,
      "type": "string",
      "when": "string"
    }
  ],
  "next_cursor": "string"
}

See the guide for a narrative walkthrough of this API.