Endpoint Global Settings updated

Following our second drop last month of Global Settings management using the Endpoint v1 API, we have just added support for managing Intrusion Prevention (IPS) exclusions.

Add a new IPS exclusion¶

Let's say the IPS component in the Sophos Endpoint Agent is blocking legitimate network communication with your server at IP address 10.23.45.156. To allow this traffic while keeping IPS active, add a new exclusion using this API call:

POST /endpoint/v1/settings/exclusions/intrusion-prevention

Request body:

{
  "comment": "Allow all inbound and outbound traffic for MyApp",               // (Optional) Record the purpose of this exclusion
  "direction": "both",   // This exclusion is effective for all inbound as well as outbound traffic
  // Other possible values are "inbound" and "outbound"
  "localAddresses": [    // Allow all traffic to and from these local IP addresses
  ],
  "localPorts": [        // Allow all traffic to and from these local ports
    10310,
    10312
  ],
  "remotePorts": [       // Allow all traffic to and from these remote ports
    8090
  ],
  "remoteAddresses": [   // Allow all traffic to and from these remote IP addresses
    "10.23.45.156"
  ]
}

The response looks like this:

{
  "id": "010aea24-4655-490a-8d3f-c47bc5ab909d",
  "type": "intrusionPrevention",
  "direction": "both",
  "localAddresses": [ ],
  "localPorts": [
    10310,
    10312
  ],
  "remotePorts": [
    8090
  ],
  "remoteAddresses": [
    "10.23.45.156"
  ],
  "comment": "Allow all inbound and outbound traffic for MyApp"
}

List IPS exclusions¶

To list these exclusion, use this API call:

GET /endpoint/v1/settings/exclusions/intrusion-prevention

The response looks like this:

{
  "items": [
    {
      "id": "4422fbfa-d34b-4d9d-b310-9b9052f69b9c",
      "type": "intrusionPrevention",
      "remotePorts": [
        1225
      ],
      "direction": "outgoing",
      "comment": "Allow outgoing traffic to Widget server"
    },
    {
      "id": "010aea24-4655-490a-8d3f-c47bc5ab909d",
      "type": "intrusionPrevention",
      "direction": "both",
      "localAddresses": [ ],
      "localPorts": [
        10310,
        10312
      ],
      "remotePorts": [
        8090
      ],
      "remoteAddresses": [
        "10.23.45.156"
      ],
      "comment": "Allow all inbound and outbound traffic for MyApp"
    },
    ...
  ],
  "pages": {
    "current": 1,
    "size": 50,
    "maxSize": 100
  }
}

See the API reference for details on how to update and delete IPS exclusions.

This rounds up our Endpoint Global Settings APIs for now. Please post your feedback to the community forum; we look forward to it.