sophos_get_detection_counts
Retrieve detection counts grouped by severity and type over a specified time range, with hourly or daily bucket resolution. Filter by tenant, rule, severity, type, and other criteria.
Instructions
Get detection counts grouped by severity and type over a time range. Returns per-hour or per-day buckets.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| type | No | Comma-separated detection types (e.g. 'threat,process,vulnerability') | |
| source | No | Sensor source to filter on (e.g. 'Sophos') | |
| to_date | No | End of time range (ISO 8601) | |
| severity | No | Comma-separated severity scores to filter on | |
| username | No | Filter by username | |
| from_date | No | Start of time range (ISO 8601) | |
| tenant_id | Yes | Tenant UUID | |
| resolution | No | Bucket resolution: 'hour' or 'day' | |
| entity_type | No | Filter by entity type (e.g. 'computer', 'server') | |
| detection_rule | No | Filter by a specific detection rule ID | |
| show_suppressed | No | If true, include suppressed detections | |
| device_name_contains | No | Filter by partial device hostname |