About the Sophos Endpoint Integration
Sophos Endpoint is Sophos’s AI-powered endpoint security and EDR product, providing threat prevention, detection, and investigation capabilities across Windows, macOS, and Linux endpoints through the Sophos Central management platform. Part of Synqly’s EDR Unified API, the Sophos Endpoint integration enables security platforms to access normalized endpoint detection data, threat alerts, and security events from Sophos-managed environments through a standardized connector. Integrate with Sophos Endpoint to route Sophos threat detections into your SIEM, SOAR, or security operations platform, enabling unified endpoint threat visibility across your security stack.
Integration Use Cases
Get Endpoint
Gets a single endpoint assets matching the UID from the token-linked EDR source.
Quarantine Endpoints
Connect or disconnect one or more endpoints assets to the network, allowing or disallowing connections.
Query Alerts
Returns a list of alerts that match the query from the token-linked EDR source.
Query Applications
Returns a list of applications matching the query from the token-linked EDR source.
Query EDR Events
Returns a list of EDR events that match the query from the token-linked EDR source.
Query Endpoints
Returns a list of endpoint assets matching the query from the token-linked EDR source.
Query Exclusions
Returns the exclusions configured in the token-linked EDR source as OCSF Compliance Findings, one per exclusion rule, with the rule's pattern, match type and scope. The filters a provider accepts, and which rules it returns when a filter is omitted, are described in that provider's filter documentation.
Query Policies
Returns the protection policies configured in the token-linked EDR source as OCSF Compliance Findings, one per policy or policy scope, with each recommended setting as an assessment and the vendor policy setting that decided it. `resource.type` selects the policies to evaluate; its values and default are described in each provider's filter documentation.
Query Posture Score
Returns the posture score of the endpoint assets that match the query from the token-linked EDR source.
Query Threat Events
Returns a list of threats that match the query from the token-linked EDR source.
