Get events¶

GET/events

Get events with timestamps within last 24 hours.

Parameters¶

Name	In	Type	Required	Description
`limit`	query	integer	No	The maximum number of items to return, default is 200, max is 1000. Must be ≥ 200 and ≤ 1000.
`cursor`	query	string	No	Identifier for next item in the list, this value is available in response as next_cursor. Response will default to last 24 hours if cursor is not within last 24 hours.
`from_date`	query	integer	No	The starting date from which alerts will be retrieved defined as Unix timestamp in UTC.Ignored if cursor is set. Must be within last 24 hours.
`exclude_types`	query	string	No	The String of list of types of events to be excluded.
`X-Tenant-ID`	header	string	Yes	The tenant ID. Required when using Bearer Token based authentication.
`from_date_offset_minutes`	query	integer	No	Delay the data collection by X minutes from API. Must be ≥ 0 and ≤ 1440.

Request samples¶

cURLPythonPowerShellGoJavaScript

curl -X GET "https://api-<data-region>.central.sophos.com/siem/v1/events" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"

import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/siem/v1/events",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())

$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/siem/v1/events" -Headers $headers

package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/siem/v1/events", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}

const response = await fetch("https://api-<data-region>.central.sophos.com/siem/v1/events", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses¶

`200` — Succeeded.¶

Response fields

has_moreboolean

itemsarray of object

This model wraps up an Event. This contains various fields that contain information regarding the event that was generated.

Show child attributesHide child attributes

amsi_threat_dataobject

Show child attributesHide child attributes

parentProcessIdstring

parentProcessPathstring

processIdstring

processNamestring

processPathstring

appCertsarray of object

Certificate info of the application associated with the threat, if available.

Show child attributesHide child attributes

signerstring

thumbprintstring

appSha256string

SHA 256 hash of the application associated with the threat, if available.

core_remedy_itemsobject

Show child attributesHide child attributes

itemsarray of object

Show child attributesHide child attributes

descriptorstring

resultstring

Must be one of: NOT_APPLICABLE, SUCCESS, NOT_FOUND, DELETED, FAILED_TO_DELETE, WHITELISTED, OTHER_ERROR, FAILED_TO_DELETE_SYSTEM_PROTECTED.

typestring

totalItemsinteger

created_atstring

The date at which the event was created.

customer_idstring

The identifier of the customer for which record is created.

detailsarray of object

Show child attributesHide child attributes

propertystring

typestring

Must be one of: CORE_EVENT_REQUEST_ID, CORE_EVENT_RESPONSE_STATUS, HMPA_EVENT_REPORT, HMPA_EVENT_TYPE, HMPA_PROCESS_VERSION, HMPA_PROCESS_PID, HMPA_PROCESS_PATH, HOME_FAMILY_ID, HOME_SCAN_LABEL, HOME_SCAN_STATE, HOME_SCAN_CLEAN, HOME_SCAN_REBOOT, HOME_COOKIES_COUNT, HOME_COOKIES_DOMAINS, HOME_REMNANT_FAMILY, HOME_REMNANT_NAME, HOME_REMNANT_PATHS, IPS_EXECUTABLE_PATH, IPS_EXECUTABLE_PID, IPS_EXECUTABLE_VERSION, IPS_EXECUTABLE_NAME, IPS_RAW_DATA, IPS_REMOTE_IP, IPS_REMOTE_PORT, IPS_LOCAL_PORT, IPS_TECH_SUPPORT_ID, AMSI_PROCESS_NAME, AMSI_PROCESS_ID, AMSI_PROCESS_PATH, AMSI_PARENT_PROCESS_ID, AMSI_PARENT_PROCESS_PATH, AMSI_THREAT_SUB_TYPE.

endpoint_idstring

The corresponding endpoint id associated with the record.

endpoint_typestring

The corresponding endpoint type associated with the record.

groupstring

The group associated with the group.

idstring

The Identifier for the event.

ips_threat_dataobject

Show child attributesHide child attributes

detectionTypeinteger

executableNamestring

executablePathstring

executablePidstring

executableVersionstring

localPortstring

rawDatastring

remoteIpstring

remotePortstring

techSupportIdstring

locationstring

The location captured for this record.

namestring

The name of the record created.

originstring

originating component of a detection.

severitystring

The severity for this alert.
Must be one of: NONE, LOW, MEDIUM, HIGH, CRITICAL.

sourcestring

The source for this record.

source_infoobject

Detailed source information for this record.

threatstring

The threat associated with the record.

typestring

The type of this record.

user_idstring

The identifier of the user for which record is created.

whenstring

The date at which the event was created.

whitelist_propertiesarray of object

Show child attributesHide child attributes

propertystring

typestring

Must be one of: SHA_256, CERTIFICATE_SIGNER, PATH, THUMBPRINT, PROCESS_NAME, MITIGATION, DETECTION_KEY.

next_cursorstring

Value of the next cursor. This will be used to make next call of API.

Errors¶

Status	Meaning
`400`	Bad Request.
`401`	Authentication Failed.
`403`	Forbidden.
`404`	Not Found.
`500`	Internal Server Error.

All error responses share the same shape — see the error response object.

Response examples¶

`200`¶

{
  "has_more": true,
  "items": [
    {
      "amsi_threat_data": {
        "parentProcessId": "string",
        "parentProcessPath": "string",
        "processId": "string",
        "processName": "string",
        "processPath": "string"
      },
      "appCerts": [
        {
          "signer": "string",
          "thumbprint": "string"
        }
      ],
      "appSha256": "string",
      "core_remedy_items": {
        "items": [
          {
            "descriptor": "string",
            "result": "NOT_APPLICABLE",
            "type": "string"
          }
        ],
        "totalItems": 0
      },
      "created_at": "string",
      "customer_id": "string",
      "details": [
        {
          "property": "string",
          "type": "CORE_EVENT_REQUEST_ID"
        }
      ],
      "endpoint_id": "string",
      "endpoint_type": "string",
      "group": "string",
      "id": "string",
      "ips_threat_data": {
        "detectionType": 0,
        "executableName": "string",
        "executablePath": "string",
        "executablePid": "string",
        "executableVersion": "string",
        "localPort": "string",
        "rawData": "string",
        "remoteIp": "string",
        "remotePort": "string",
        "techSupportId": "string"
      },
      "location": "string",
      "name": "string",
      "origin": "string",
      "severity": "NONE",
      "source": "string",
      "source_info": {},
      "threat": "string",
      "type": "string",
      "user_id": "string",
      "when": "string",
      "whitelist_properties": [
        {
          "property": "string",
          "type": "SHA_256"
        }
      ]
    }
  ],
  "next_cursor": "string"
}

See the guide for a narrative walkthrough of this API.

Get events¶

Parameters¶

Request samples¶

Responses¶

200 — Succeeded.¶

Errors¶

Response examples¶

200¶

`200` — Succeeded.¶

`200`¶