Skip to content

Getting started

Overview

This guide explains how to use the SIEM Integration API. After you read this guide, you can pull events and alerts from Sophos Central into your SIEM.

The API returns data from the last 24 hours. It powers the siem.py tool, which you can use instead of calling the API directly.

Pre-requisites

You must have a set of API credentials (service principal) to be able to call the SIEM Integration API. For more information refer to the appropriate quick start guide:

Making API requests

You can make the API calls in the next few sections using cURL. Follow the instructions on cURL's website to install this tool.

When using curl, a request to the SIEM Integration API has the following general form:

curl -X GET -H "Authorization: Bearer <jwt>" -H "X-Tenant-ID: <tenant-id>" "https://api-<data-region>.central.sophos.com/siem/v1/<path>"

The command includes the following placeholders:

  • <jwt>: The JWT access token returned when the IDP authenticates the service principal.
  • <tenant-id>: The ID of the tenant you want to query.
  • <data-region>: The regional API host in the data geography where the tenant data is located, for example eu01.
  • <path>: The request path for the API operation. This is events or alerts.

All API requests return HTTP status code 200 when successful.

Get events

To get the events from the last 24 hours, call:

GET siem/v1/events

Response: This returns a page of events, a cursor, and a flag that tells you if more pages exist.

{
    "has_more": false,
    "items": [
        {
            "id": "6d4a3c9e-73f1-4b3a-9b0e-2a4c1a2b3c4d",
            "severity": "MEDIUM",
            "group": "MALWARE",
            "type": "Event::Endpoint::Threat::Detected",
            "name": "Malware detected: 'EICAR-AV-Test'",
            "location": "FINANCE-LAPTOP-07",
            "when": "2026-08-03T09:12:44.000Z",
            "created_at": "2026-08-03T09:12:45.317Z"
        }
    ],
    "next_cursor": "VjJfQ1VSU09SfDIwMjYtMDgtMDNUMDk6MTI6NDUuMzE3Wg=="
}

See the event schema for all fields and their allowed values.

Get alerts

To get the alerts from the last 24 hours, call:

GET siem/v1/alerts

The response has the same shape as the events response: a page of items, a next_cursor value, and has_more. See the alert schema for all fields.

Limit the results

Use the limit query parameter to set the page size. The default is 200 items. The maximum is 1000 items.

GET siem/v1/events?limit=1000

Use the from_date query parameter to set the start of the time range. Give a Unix timestamp in UTC. The timestamp must be within the last 24 hours.

GET siem/v1/events?from_date=1785715200

Page through the results

When has_more is true, more results exist. To get the next page, send the next_cursor value as the cursor query parameter:

GET siem/v1/events?cursor=<next_cursor>

The API ignores from_date when you set cursor. If the cursor is older than 24 hours, the API returns the last 24 hours of data.

Repeat the call with each new next_cursor value until has_more is false.

More resources