sophos-mcp

Search Sophos Central security events by type, severity, endpoint, source, and date range — the primary SIEM event feed

Get full details of a specific Sophos Central security event including customer data, IOCs, and endpoint context

List available Sophos Central security event types and their descriptions — useful for building event search queries

Get the admin audit trail from Sophos Central — tracks all administrative actions including policy changes, user management, and configuration updates

Execute a Live Discover SQL query (osquery) on one or more Sophos Central endpoints — for real-time investigation and threat hunting

List saved Live Discover queries in Sophos Central — includes built-in and custom queries with their SQL and supported platforms

Retrieve results from a completed Live Discover query run — returns tabular data from each endpoint

List available Live Discover query categories with descriptions and example queries — helps discover what you can query

List Sophos EDR/XDR detections with optional filters for severity, type, endpoint, and date range

Get full details of a Sophos EDR/XDR detection including process tree, MITRE ATT&CK mapping, indicators, and raw event data

List Sophos threat cases — groups of related EDR/XDR detections that form a single incident narrative

Get all detections within a Sophos threat case — shows every detection that contributed to the case

Update the status of a Sophos threat case and optionally assign it to an analyst

List Sophos Central alerts with optional filters for severity, category, product, and date range

Get full details of a specific Sophos Central alert including description, managed agent info, and available response actions

Acknowledge a Sophos Central alert — marks it as reviewed without resolving it

Resolve and close a Sophos Central alert with a description of the action taken

List available response actions for a specific Sophos Central alert — determines what actions can be performed

List Sophos Central endpoint, server, and firewall policies with optional type filter

Get full configuration details of a specific Sophos Central policy including all settings and scope

Get specific settings within a Sophos Central policy — extracts and formats individual configuration sections for easier analysis

List global and policy-specific scanning exclusions in Sophos Central — important for security audits and troubleshooting false positives

List managed tenants in Sophos Central — MSP/partner view of all managed organizations with status and billing info

Get full details of a managed tenant including contact info, license details, and data region

Get overall security health score for a tenant — endpoint protection coverage, active threats, and compliance metrics

List Sophos Central managed endpoints with optional filters for hostname, health status, OS platform, type, group, tamper protection, and isolation state

Get full details of a specific Sophos Central endpoint including health status, assigned products, tamper protection, isolation state, and associated person

Network isolate a Sophos Central endpoint for incident response — the endpoint can only communicate with Sophos Central

Remove network isolation from a Sophos Central endpoint, restoring normal network connectivity

Trigger a full on-demand antivirus scan on a Sophos Central endpoint

List installed software on a Sophos Central endpoint — useful for vulnerability assessment and software inventory