sophos_list_audit_events
Retrieve audit trail events for a Sophos Central tenant, filtering by date, category, user, and paginating to track admin actions, policy changes, and logins.
Instructions
List audit trail events for a Sophos Central tenant. Covers admin actions, policy changes, user logins, and configuration modifications. Supports filtering by date range, category, user, and cursor-based pagination.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cursor | No | Pagination cursor returned by a previous response to fetch the next page of results | |
| to_date | No | Return events at or before this ISO 8601 UTC timestamp (e.g. '2024-01-31T23:59:59.999Z') | |
| user_id | No | Filter events to those performed by a specific user ID | |
| category | No | Filter by audit event category (e.g. 'policy', 'endpoint', 'iam', 'firewall') | |
| from_date | No | Return events at or after this ISO 8601 UTC timestamp (e.g. '2024-01-01T00:00:00.000Z') | |
| page_size | No | Number of events per page (1–100, default 50) | |
| tenant_id | Yes | Tenant UUID | |
| max_results | No | Maximum total number of audit events to return across all pages (used to cap large result sets) |