sophos_get_siem_events
Retrieve Sophos security events from the last 24 hours for integration with external SIEM systems, with pagination support using cursors.
Instructions
Retrieve security events from the Sophos SIEM API for integration with external SIEM systems. Events are from the last 24 hours only. Use the cursor from the response (next_cursor) to paginate; check has_more to know if more pages exist.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of events to return per request (min 200, max 1000, default 200) | |
| cursor | No | Pagination cursor from a previous response (next_cursor field) to fetch the next batch of events | |
| from_date | No | Return events after this point in time. Must be a UTC Unix timestamp (seconds since epoch, e.g. '1700000000'). Must be within the last 24 hours. | |
| tenant_id | Yes | The tenant ID to query SIEM events for | |
| exclude_types | No | Comma-separated list of event type strings to exclude from results (e.g. 'Event::Endpoint::UpdateSuccess,Event::Endpoint::Application::Detected') |