XDR Query API¶
Run XDR queries against the Sophos Data Lake.
See the guide for a narrative walkthrough of this API.
Base URL¶
https://api-{dataRegion}.central.sophos.com/xdr-query/v1 — Regional service in the production environment.
| Variable | Description | Default | Allowed values |
|---|---|---|---|
dataRegion | Data region where the service is. | eu01 | eu01, eu02, us01, us03, ca01, au01, jp01, in01, br01, ae01 |
Authentication¶
Every request carries an Authorization: Bearer header with an access token obtained through the client-credentials flow — see Get started.
Operations¶
Category¶
- List categories
GET/queries/categories - Get a category
GET/queries/categories/{categoryId}
Query¶
- List queries
GET/queries - Get a query
GET/queries/{queryId}
Runs¶
- List query runs
GET/queries/runs - Run query
POST/queries/runs - Get query run
GET/queries/runs/{runId} - Cancel query run
POST/queries/runs/{runId}/cancel - Get results
GET/queries/runs/{runId}/results
Download¶