sophos_list_cases
List all security cases for a tenant, with filters by type, severity, status, assignee, and more. Supports pagination and sorting to quickly find specific investigations.
Instructions
List all cases/investigations for a tenant with rich filtering options.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Exact match by case name | |
| page | No | Page number (1-based) | |
| sort | No | Sort column e.g. 'type:asc', 'severity:desc' | |
| type | No | Filter by case type | |
| status | No | Filter by case status. Self-managed cases support new/investigating/onHold/resolved; Sophos-managed also have actionRequired | |
| verdict | No | Filter by case verdict | |
| assignee | No | Filter by assignee email, or 'Unassigned' | |
| severity | No | Filter by case severity | |
| escalated | No | Filter by escalation status | |
| page_size | No | Results per page | |
| tenant_id | Yes | Tenant UUID | |
| managed_by | No | Filter by who manages the case ('self' or 'sophos') | |
| created_after | No | Return cases created after this timestamp or duration | |
| created_before | No | Return cases created before this timestamp or duration | |
| overview_contains | No | Partial match on case overview text |