sophos_list_alerts
Retrieve and filter security alerts from Sophos Central by tenant, severity, product, category, and date range, with pagination support.
Instructions
List alerts from Sophos Central for a given tenant, with optional severity, product, category, date range, and pagination filters.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ids | No | Comma-separated list of specific alert IDs to retrieve | |
| sort | No | Sort order (e.g. 'raisedAt:desc') | |
| product | No | Comma-separated product names to filter on (e.g. 'endpoint,server,wireless,mobile') | |
| to_date | No | Return alerts raised before this ISO 8601 timestamp | |
| category | No | Comma-separated alert categories to filter on (e.g. 'malware,policy,runtimeDetections,applicationControl') | |
| page_key | No | Pagination key for fetching the next page of results | |
| severity | No | Comma-separated severity levels to filter on (e.g. 'high,medium,low') | |
| from_date | No | Return alerts raised after this ISO 8601 timestamp | |
| page_size | No | Number of alerts per page (default 50) | |
| tenant_id | Yes | The tenant ID to query alerts for | |
| page_total | No | If true, include total page count in the response |