category: Data Enrichment & Threat Intelligence
provider: Thoma Bravo
sectionorder:
- Connect
- Collect
commonfields:
  id: Sophos Central
  version: -1
configuration:
- display: Client ID
  displaypassword: Client Secret
  name: credentials
  type: 9
  required: true
  additionalinfo: The Sophos account secret should be in the password field.
  section: Connect
- display: Tenant ID
  name: tenant_id
  additionalinfo: Tenant ID on which the commands would be executed by default. Keep it empty if using tenant level credentials.
  type: 0
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- additionalinfo: Choose the severity(s) (not minimum) to fetch. If none is chosen, all severity levels will be returned.
  display: Fetch Severity
  section: Collect
  name: fetch_severity
  options:
  - low
  - medium
  - high
  type: 16
  required: false
- additionalinfo: Choose one or more categories to fetch. If none is chosen, all categories will be returned.
  display: Fetch Category
  name: fetch_category
  options:
  - azure
  - adSync
  - applicationControl
  - appReputation
  - blockListed
  - connectivity
  - cwg
  - denc
  - downloadReputation
  - endpointFirewall
  - fenc
  - forensicSnapshot
  - general
  - iaas
  - iaasAzure
  - isolation
  - malware
  - mtr
  - mobiles
  - policy
  - protection
  - pua
  - runtimeDetections
  - security
  - smc
  - systemHealth
  - uav
  - uncategorized
  - updating
  - utm
  - virt
  - wireless
  - xgEmail
  type: 16
  section: Collect
  advanced: true
  required: false
- additionalinfo: Maximum number of alerts per fetch. Default is 50. Maximum is 100.
  defaultvalue: '50'
  display: Fetch Limit
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
description: The unified console for managing Sophos products.
display: Sophos Central
name: Sophos Central
script:
  commands:
  - arguments:
    - defaultValue: '50'
      description: The maximum number of items to return. Default is "50". Maximum is "100".
      name: limit
    description: List alerts.
    name: sophos-central-alert-list
    outputs:
    - contextPath: SophosCentral.Alert.allowedActions
      description: Actions that you can perform on these alerts.
      type: String
    - contextPath: SophosCentral.Alert.category
      description: Alert category.
      type: String
    - contextPath: SophosCentral.Alert.description
      description: Alert description.
      type: String
    - contextPath: SophosCentral.Alert.groupKey
      description: Alert group key.
      type: String
    - contextPath: SophosCentral.Alert.id
      description: The alert ID.
      type: String
    - contextPath: SophosCentral.Alert.managedAgentId
      description: The alert source ID.
      type: String
    - contextPath: SophosCentral.Alert.managedAgentName
      description: The alert source name.
      type: String
    - contextPath: SophosCentral.Alert.managedAgentType
      description: The source that triggered the alert.
      type: String
    - contextPath: SophosCentral.Alert.person
      description: The ID of the referenced person object.
      type: String
    - contextPath: SophosCentral.Alert.personName
      description: The name of the referenced person object.
      type: String
    - contextPath: SophosCentral.Alert.product
      description: Product type.
      type: String
    - contextPath: SophosCentral.Alert.raisedAt
      description: When the alert was triggered.
      type: Date
    - contextPath: SophosCentral.Alert.severity
      description: Severity level for the alert.
      type: String
    - contextPath: SophosCentral.Alert.tenantId
      description: Tenant ID for the alert.
      type: String
    - contextPath: SophosCentral.Alert.tenantName
      description: Tenant name.
      type: String
    - contextPath: SophosCentral.Alert.type
      description: Alert type.
      type: String
  - arguments:
    - description: The alert ID.
      name: alert_id
      required: true
    description: Get a single alert by ID.
    name: sophos-central-alert-get
    outputs:
    - contextPath: SophosCentral.Alert.allowedActions
      description: Actions that you can perform on these alerts.
      type: String
    - contextPath: SophosCentral.Alert.category
      description: Alert category.
      type: String
    - contextPath: SophosCentral.Alert.description
      description: Alert description.
      type: String
    - contextPath: SophosCentral.Alert.groupKey
      description: Alert group key.
      type: String
    - contextPath: SophosCentral.Alert.id
      description: The alert ID.
      type: String
    - contextPath: SophosCentral.Alert.managedAgentId
      description: The alert source ID.
      type: String
    - contextPath: SophosCentral.Alert.managedAgentName
      description: The alert source name.
      type: String
    - contextPath: SophosCentral.Alert.managedAgentType
      description: The source that triggered the alert.
      type: String
    - contextPath: SophosCentral.Alert.person
      description: The ID of the referenced person object.
      type: String
    - contextPath: SophosCentral.Alert.personName
      description: The name of the referenced person object.
      type: String
    - contextPath: SophosCentral.Alert.product
      description: Product type.
      type: String
    - contextPath: SophosCentral.Alert.raisedAt
      description: When the alert was triggered.
      type: Date
    - contextPath: SophosCentral.Alert.severity
      description: Severity level for the alert.
      type: String
    - contextPath: SophosCentral.Alert.tenantId
      description: Tenant ID for the alert.
      type: String
    - contextPath: SophosCentral.Alert.tenantName
      description: Tenant name.
      type: String
    - contextPath: SophosCentral.Alert.type
      description: Alert type.
      type: String
  - arguments:
    - description: Comma-separated list of alert IDs.
      isArray: true
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: 'Actions to perform on the alerts. Possible values are: "acknowledge", "cleanPua", "cleanVirus", "authPua", "clearThreat", "clearHmpa", "sendMsgPua", and "sendMsgThreat".'
      name: action
      predefined:
      - acknowledge
      - cleanPua
      - cleanVirus
      - authPua
      - clearThreat
      - clearHmpa
      - sendMsgPua
      - sendMsgThreat
      required: true
    - description: Message to send for the action.
      name: message
    description: Perform an action on the alerts.
    name: sophos-central-alert-action
    outputs:
    - contextPath: SophosCentral.AlertAction.action
      description: Actions that you can perform on the alert.
      type: String
    - contextPath: SophosCentral.AlertAction.alertId
      description: Alert ID.
      type: String
    - contextPath: SophosCentral.AlertAction.completedAt
      description: Time when the action was completed.
      type: Date
    - contextPath: SophosCentral.AlertAction.id
      description: Alert action ID.
      type: String
    - contextPath: SophosCentral.AlertAction.requestedAt
      description: Time when the action was requested.
      type: Date
    - contextPath: SophosCentral.AlertAction.result
      description: The result of the action.
      type: String
    - contextPath: SophosCentral.AlertAction.startedAt
      description: Time when the action was started.
      type: Date
    - contextPath: SophosCentral.AlertAction.status
      description: Status of an alert action.
      type: String
  - arguments:
    - description: Alert group key.
      name: group_key
    - description: Time on which or after the alerts were raised. Use ISO time format (YYYY-MM-DDTHH:MM:SSZ).
      name: start
    - description: Time before which alerts were raised. Use ISO time format (YYYY-MM-DDTHH:MM:SSZ).
      name: end
    - description: The date range in which to search from the current time instead of a start/end time in the format (<number> <time unit>, e.g., 12 hours, 7 days). date_range will overwrite the start and end arguments if defined.
      name: date_range
    - auto: PREDEFINED
      description: 'Alerts for a product(s). Possible values are: "other", "endpoint", "server", "mobile", "encryption", "emailGateway", "webGateway", "phishThreat", "wireless", "iaas", and "firewall".'
      isArray: true
      name: product
      predefined:
      - other
      - endpoint
      - server
      - mobile
      - encryption
      - emailGateway
      - webGateway
      - phishThreat
      - wireless
      - iaas
      - firewall
    - auto: PREDEFINED
      description: Alert category(s).
      isArray: true
      name: category
      predefined:
      - azure
      - adSync
      - applicationControl
      - appReputation
      - blockListed
      - connectivity
      - cwg
      - denc
      - downloadReputation
      - endpointFirewall
      - fenc
      - forensicSnapshot
      - general
      - iaas
      - iaasAzure
      - isolation
      - malware
      - mtr
      - mobiles
      - policy
      - protection
      - pua
      - runtimeDetections
      - security
      - smc
      - systemHealth
      - uav
      - uncategorized
      - updating
      - utm
      - virt
      - wireless
      - xgEmail
    - auto: PREDEFINED
      description: 'Alerts for a specific severity level(s). Possible values are: "high", "medium", and "low".'
      isArray: true
      name: severity
      predefined:
      - high
      - medium
      - low
    - description: List of IDs.
      isArray: true
      name: ids
    - defaultValue: '50'
      description: The maximum number of items to return. Default is "50". Maximum is "100".
      name: limit
    description: Get alerts matching request.
    name: sophos-central-alert-search
    outputs:
    - contextPath: SophosCentral.Alert.allowedActions
      description: Actions that you can perform on these alerts.
      type: String
    - contextPath: SophosCentral.Alert.category
      description: Alert category.
      type: String
    - contextPath: SophosCentral.Alert.description
      description: Alert description.
      type: String
    - contextPath: SophosCentral.Alert.groupKey
      description: Alert group key.
      type: String
    - contextPath: SophosCentral.Alert.id
      description: The alert ID.
      type: String
    - contextPath: SophosCentral.Alert.managedAgentId
      description: The alert source ID.
      type: String
    - contextPath: SophosCentral.Alert.managedAgentName
      description: The alert source name.
      type: String
    - contextPath: SophosCentral.Alert.managedAgentType
      description: The source that triggered the alert.
      type: String
    - contextPath: SophosCentral.Alert.person
      description: The ID of the referenced person object.
      type: String
    - contextPath: SophosCentral.Alert.personName
      description: The name of the referenced person object.
      type: String
    - contextPath: SophosCentral.Alert.product
      description: Product type.
      type: String
    - contextPath: SophosCentral.Alert.raisedAt
      description: When the alert was triggered.
      type: Date
    - contextPath: SophosCentral.Alert.severity
      description: Severity level for the alert.
      type: String
    - contextPath: SophosCentral.Alert.tenantId
      description: Tenant ID for the Alert.
      type: String
    - contextPath: SophosCentral.Alert.tenantName
      description: Tenant name.
      type: String
    - contextPath: SophosCentral.Alert.type
      description: Alert type.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: 'Match endpoints that have any of the specified health statuses. Possible values are: "bad", "good", "suspicious", and "unknown".'
      isArray: true
      name: health_status
      predefined:
      - bad
      - good
      - suspicious
      - unknown
    - auto: PREDEFINED
      description: 'Match endpoints that have any of the specified endpoint types. Possible values are: "computer", "server", and "securityVm".'
      isArray: true
      name: endpoint_type
      predefined:
      - computer
      - server
      - securityVm
    - auto: PREDEFINED
      description: 'Whether tamper protection is enabled. Possible values are: "true" and "false".'
      name: tamper_protection_enabled
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: 'Match endpoints that have any of the specified lockdown statuses. Possible values are: "creatingWhitelist", "installing", "locked", "notInstalled", "registering", "starting", "stopping", "unavailable", "uninstalled", and "unlocked".'
      isArray: true
      name: lockdown_status
      predefined:
      - creatingWhitelist
      - installing
      - locked
      - notInstalled
      - registering
      - starting
      - stopping
      - unavailable
      - uninstalled
      - unlocked
    - description: The datetime before which the endpoints were last seen (UTC).
      name: last_seen_before
    - description: The datetime on or after which the endpoints were last seen (UTC).
      name: last_seen_after
    - description: List of IDs.
      isArray: true
      name: ids
    - auto: PREDEFINED
      description: 'Type of view to be returned in the response. Possible values are: "basic", "summary", and "full".'
      name: view
      predefined:
      - basic
      - summary
      - full
    - defaultValue: '50'
      description: The maximum number of items to return. Default is "50". Maximum is "100".
      name: limit
    - name: ip_addresses
      isArray: true
      description: 'List of IP addresses to find endpoints for.'
    - name: hostname_contains
      description: Find endpoints where the hostname contains the given string. Only the first 10 characters of the given string are matched.
    - auto: PREDEFINED
      name: full_match_ip
      description: 'Whether the IP addresses should match full or not (partial/default).'
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      name: full_match_hostname
      description: 'Whether the hostname should match full or not (partial/default).'
      predefined:
      - 'true'
      - 'false'
    description: List all endpoints for a tenant.
    name: sophos-central-endpoint-list
    outputs:
    - contextPath: SophosCentral.Endpoint.assignedProductCodes
      description: Code of a product assigned to the endpoint.
      type: String
    - contextPath: SophosCentral.Endpoint.associatedPersonId
      description: The unique ID for the person associated with the endpoint.
      type: String
    - contextPath: SophosCentral.Endpoint.associatedPersonName
      description: Name of the person associated with the endpoint.
      type: String
    - contextPath: SophosCentral.Endpoint.associatedPersonViaLogin
      description: The login of the person associated with the endpoint.
      type: String
    - contextPath: SophosCentral.Endpoint.groupId
      description: The unique ID for the endpoint group.
      type: String
    - contextPath: SophosCentral.Endpoint.groupName
      description: Endpoint group name.
      type: String
    - contextPath: SophosCentral.Endpoint.hostname
      description: The hostname of the endpoint.
      type: String
    - contextPath: SophosCentral.Endpoint.id
      description: The unique ID for the endpoint.
      type: String
    - contextPath: SophosCentral.Endpoint.health
      description: Health status of the endpoint.
      type: String
    - contextPath: SophosCentral.Endpoint.ipv4Addresses
      description: IPv4 address of the endpoint.
      type: String
    - contextPath: SophosCentral.Endpoint.ipv6Addresses
      description: IPv6 address of the endpoint.
      type: String
    - contextPath: SophosCentral.Endpoint.macAddresses
      description: MAC address of the endpoint.
      type: String
    - contextPath: SophosCentral.Endpoint.osBuild
      description: Operating system build.
      type: String
    - contextPath: SophosCentral.Endpoint.osIsServer
      description: Whether the operating system is a server operating system.
      type: Boolean
    - contextPath: SophosCentral.Endpoint.osName
      description: Operating system name as reported by the endpoint.
      type: String
    - contextPath: SophosCentral.Endpoint.osPlatform
      description: Operating system platform type.
      type: String
    - contextPath: SophosCentral.Endpoint.tamperProtectionEnabled
      description: Whether tamper protection is enabled.
      type: Boolean
    - contextPath: SophosCentral.Endpoint.type
      description: The endpoint type.
      type: String
    - contextPath: SophosCentral.Endpoint.online
      description: Whether the endpoint is online.
      type: Boolean
  - arguments:
    - description: The endpoint ID(s).
      isArray: true
      name: endpoint_id
      required: true
    description: Scan endpoints of a tenant.
    name: sophos-central-endpoint-scan
    outputs:
    - contextPath: SophosCentral.EndpointScan.id
      description: Identifies a request to perform or configure the endpoint scan.
      type: String
    - contextPath: SophosCentral.EndpointScan.requestedAt
      description: Time when the scan was requested.
      type: Date
    - contextPath: SophosCentral.EndpointScan.status
      description: The status of an endpoint scan.
      type: String
  - arguments:
    - description: The endpoint ID(s).
      isArray: true
      name: endpoint_id
      required: true
    - auto: PREDEFINED
      default: true
      defaultValue: false
      description: 'Whether to return the tamper protection password. Possible values are: "true" and "false".'
      name: get_password
      predefined:
      - 'true'
      - 'false'
    description: Get tamper protection information for one or more endpoints. Potentially harmful because of the password.
    execution: true
    name: sophos-central-endpoint-tamper-get
    outputs:
    - contextPath: SophosCentral.EndpointTamper.endpointId
      description: ID of the endpoint in regards to the tamper settings.
      type: String
    - contextPath: SophosCentral.EndpointTamper.enabled
      description: Whether tamper protection should be turned on for the endpoint.
      type: String
    - contextPath: SophosCentral.EndpointTamper.password
      description: Current tamper protection password.
      type: String
  - arguments:
    - description: The endpoint ID(s).
      isArray: true
      name: endpoint_id
      required: true
    - auto: PREDEFINED
      description: 'Whether tamper protection should be turned on for the endpoint. Possible values are: "true" and "false".'
      name: enabled
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      default: true
      defaultValue: false
      description: 'Whether to return the tamper protection password. Possible values are: "true" and "false".'
      name: get_password
      predefined:
      - 'true'
      - 'false'
    description: Update tamper protection information for one or more endpoints. Potentially harmful because of the password.
    execution: true
    name: sophos-central-endpoint-tamper-update
    outputs:
    - contextPath: SophosCentral.EndpointTamper.endpointId
      description: ID of the endpoint in regards to the tamper settings.
      type: String
    - contextPath: SophosCentral.EndpointTamper.enabled
      description: Whether tamper protection should be turned on for the endpoint.
      type: String
    - contextPath: SophosCentral.EndpointTamper.password
      description: Current tamper protection password.
      type: String
  - arguments:
    - defaultValue: '50'
      description: The maximum size of the page requested. Default is "50". Maximum is "100".
      name: page_size
    - defaultValue: '1'
      description: Page number to return. Default is "1".
      name: page
    description: List all allowed items.
    name: sophos-central-allowed-item-list
    outputs:
    - contextPath: SophosCentral.AllowedItem.comment
      description: A comment indicating why the item was allowed.
      type: String
    - contextPath: SophosCentral.AllowedItem.createdAt
      description: Date and time (UTC) when the allowed application was created.
      type: Date
    - contextPath: SophosCentral.AllowedItem.createdById
      description: The unique ID for the user who created the item.
      type: String
    - contextPath: SophosCentral.AllowedItem.createdByName
      description: The name for the user who created the item.
      type: String
    - contextPath: SophosCentral.AllowedItem.id
      description: The unique ID for the allowed application.
      type: String
    - contextPath: SophosCentral.AllowedItem.certificateSigner
      description: The value saved for the certificateSigner.
      type: String
    - contextPath: SophosCentral.AllowedItem.fileName
      description: The file name.
      type: String
    - contextPath: SophosCentral.AllowedItem.path
      description: The path for the application.
      type: String
    - contextPath: SophosCentral.AllowedItem.sha256
      description: The SHA256 value for the application.
      type: String
    - contextPath: SophosCentral.AllowedItem.type
      description: The property by which an item is allowed.
      type: String
    - contextPath: SophosCentral.AllowedItem.updatedAt
      description: Date and time (UTC) when the allowed application was updated.
      type: Date
    - contextPath: SophosCentral.AllowedItem.originEndpointId
      description: ID of the originating endpoint.
      type: String
    - contextPath: SophosCentral.AllowedItem.originPersonId
      description: ID of the originating person.
      type: String
    - contextPath: SophosCentral.AllowedItem.originPersonName
      description: Name of the originating person.
      type: String
  - arguments:
    - description: The ID of the allowed item.
      name: allowed_item_id
      required: true
    description: Get a single allowed item by ID.
    name: sophos-central-allowed-item-get
    outputs:
    - contextPath: SophosCentral.AllowedItem.comment
      description: A comment indicating why the item was allowed.
      type: String
    - contextPath: SophosCentral.AllowedItem.createdAt
      description: Date and time (UTC) when the allowed application was created.
      type: Date
    - contextPath: SophosCentral.AllowedItem.createdById
      description: The unique ID for the user who created the item.
      type: String
    - contextPath: SophosCentral.AllowedItem.createdByName
      description: The name for the user who created the item.
      type: String
    - contextPath: SophosCentral.AllowedItem.id
      description: The unique ID for the allowed application.
      type: String
    - contextPath: SophosCentral.AllowedItem.certificateSigner
      description: The value saved for the certificateSigner.
      type: String
    - contextPath: SophosCentral.AllowedItem.fileName
      description: The file name.
      type: String
    - contextPath: SophosCentral.AllowedItem.path
      description: The path for the application.
      type: String
    - contextPath: SophosCentral.AllowedItem.sha256
      description: The SHA256 value for the application.
      type: String
    - contextPath: SophosCentral.AllowedItem.type
      description: The property by which an item is allowed.
      type: String
    - contextPath: SophosCentral.AllowedItem.updatedAt
      description: Date and time (UTC) when the allowed application was updated.
      type: Date
    - contextPath: SophosCentral.AllowedItem.originEndpointId
      description: ID of the originating endpoint.
      type: String
    - contextPath: SophosCentral.AllowedItem.originPersonId
      description: ID of the originating person.
      type: String
    - contextPath: SophosCentral.AllowedItem.originPersonName
      description: Name of the originating person.
      type: String
  - arguments:
    - description: Comment indicating why the item should be allowed.
      name: comment
      required: true
    - description: The value saved for the certificateSigner.
      name: certificate_signer
    - description: The file name.
      name: file_name
    - description: The path for the application.
      name: path
    - description: The SHA256 value for the application.
      name: sha256
    - auto: PREDEFINED
      description: 'The property by which an item is allowed. Note that the specified item type requires the matching argument filled. For example, the item type "path" requires the path argument. Possible values are: "path", "sha256", and "certificateSigner".'
      name: item_type
      predefined:
      - path
      - sha256
      - certificateSigner
      required: true
    - description: The endpoint where the item to be allowed was last seen.
      name: origin_endpoint_id
    description: Add a new allowed item.
    name: sophos-central-allowed-item-add
    outputs:
    - contextPath: SophosCentral.AllowedItem.comment
      description: A comment indicating why the item was allowed.
      type: String
    - contextPath: SophosCentral.AllowedItem.createdAt
      description: Date and time (UTC) when the allowed application was created.
      type: Date
    - contextPath: SophosCentral.AllowedItem.createdById
      description: The unique ID for the user who created the item.
      type: String
    - contextPath: SophosCentral.AllowedItem.createdByName
      description: The name for the user who created the item.
      type: String
    - contextPath: SophosCentral.AllowedItem.id
      description: The unique ID for the allowed application.
      type: String
    - contextPath: SophosCentral.AllowedItem.certificateSigner
      description: The value saved for the certificateSigner.
      type: String
    - contextPath: SophosCentral.AllowedItem.fileName
      description: The file name.
      type: String
    - contextPath: SophosCentral.AllowedItem.path
      description: The path for the application.
      type: String
    - contextPath: SophosCentral.AllowedItem.sha256
      description: The SHA256 value for the application.
      type: String
    - contextPath: SophosCentral.AllowedItem.type
      description: The property by which an item is allowed.
      type: String
    - contextPath: SophosCentral.AllowedItem.updatedAt
      description: Date and time (UTC) when the allowed application was updated.
      type: Date
    - contextPath: SophosCentral.AllowedItem.originEndpointId
      description: ID of the originating endpoint.
      type: String
    - contextPath: SophosCentral.AllowedItem.originPersonId
      description: ID of the originating person.
      type: String
    - contextPath: SophosCentral.AllowedItem.originPersonName
      description: Name of the originating person.
      type: String
  - arguments:
    - description: The allowed item ID.
      name: allowed_item_id
      required: true
    - description: Comment indicating why the item should be allowed.
      name: comment
      required: true
    description: Update an existing allowed item.
    name: sophos-central-allowed-item-update
    outputs:
    - contextPath: SophosCentral.AllowedItem.comment
      description: A comment indicating why the item was allowed.
      type: String
    - contextPath: SophosCentral.AllowedItem.createdAt
      description: Date and time (UTC) when the allowed application was created.
      type: Date
    - contextPath: SophosCentral.AllowedItem.createdById
      description: The unique ID for the user who created the item.
      type: String
    - contextPath: SophosCentral.AllowedItem.createdByName
      description: The name for the user who created the item.
      type: String
    - contextPath: SophosCentral.AllowedItem.id
      description: The unique ID for the allowed application.
      type: String
    - contextPath: SophosCentral.AllowedItem.certificateSigner
      description: The value saved for the certificateSigner.
      type: String
    - contextPath: SophosCentral.AllowedItem.fileName
      description: The file name.
      type: String
    - contextPath: SophosCentral.AllowedItem.path
      description: The path for the application.
      type: String
    - contextPath: SophosCentral.AllowedItem.sha256
      description: The SHA256 value for the application.
      type: String
    - contextPath: SophosCentral.AllowedItem.type
      description: The property by which an item is allowed.
      type: String
    - contextPath: SophosCentral.AllowedItem.updatedAt
      description: Date and time (UTC) when the allowed application was updated.
      type: Date
    - contextPath: SophosCentral.AllowedItem.originEndpointId
      description: ID of the originating endpoint.
      type: String
    - contextPath: SophosCentral.AllowedItem.originPersonId
      description: ID of the originating person.
      type: String
    - contextPath: SophosCentral.AllowedItem.originPersonName
      description: Name of the originating person.
      type: String
  - arguments:
    - description: The allowed item ID.
      name: allowed_item_id
      required: true
    description: Delete an existing allowed item.
    name: sophos-central-allowed-item-delete
    outputs:
    - contextPath: SophosCentral.DeletedAllowedItem.deletedItemId
      description: The ID of the deleted item.
      type: String
  - arguments:
    - defaultValue: '50'
      description: The maximum size of the page requested. Default is "50". Maximum is "100".
      name: page_size
    - defaultValue: '1'
      description: Page number to return. Default is "1".
      name: page
    description: Get all blocked items.
    name: sophos-central-blocked-item-list
    outputs:
    - contextPath: SophosCentral.BlockedItem.comment
      description: A comment indicating why the item was allowed.
      type: String
    - contextPath: SophosCentral.BlockedItem.createdAt
      description: Date and time (UTC) when the allowed application was created.
      type: Date
    - contextPath: SophosCentral.BlockedItem.createdById
      description: The unique ID for the user who created the item.
      type: String
    - contextPath: SophosCentral.BlockedItem.createdByName
      description: The name for the user who created the item.
      type: String
    - contextPath: SophosCentral.BlockedItem.id
      description: The unique ID for the allowed application.
      type: String
    - contextPath: SophosCentral.BlockedItem.certificateSigner
      description: The value saved for the certificateSigner.
      type: String
    - contextPath: SophosCentral.BlockedItem.fileName
      description: The file name.
      type: String
    - contextPath: SophosCentral.BlockedItem.path
      description: The path for the application.
      type: String
    - contextPath: SophosCentral.BlockedItem.sha256
      description: The SHA256 value for the application.
      type: String
    - contextPath: SophosCentral.BlockedItem.type
      description: The property by which an item is allowed.
      type: String
    - contextPath: SophosCentral.BlockedItem.updatedAt
      description: Date and time (UTC) when the allowed application was updated.
      type: Date
    - contextPath: SophosCentral.BlockedItem.originEndpointId
      description: ID of the originating endpoint.
      type: String
    - contextPath: SophosCentral.BlockedItem.originPersonId
      description: ID of the originating person.
      type: String
    - contextPath: SophosCentral.BlockedItem.originPersonName
      description: Name of the originating person.
      type: String
  - arguments:
    - description: The blocked item ID.
      name: blocked_item_id
      required: true
    description: Get a single blocked item by ID.
    name: sophos-central-blocked-item-get
    outputs:
    - contextPath: SophosCentral.BlockedItem.comment
      description: A comment indicating why the item was allowed.
      type: String
    - contextPath: SophosCentral.BlockedItem.createdAt
      description: Date and time (UTC) when the allowed application was created.
      type: Date
    - contextPath: SophosCentral.BlockedItem.createdById
      description: The unique ID for the user who created the item.
      type: String
    - contextPath: SophosCentral.BlockedItem.createdByName
      description: The name for the user who created the item.
      type: String
    - contextPath: SophosCentral.BlockedItem.id
      description: The unique ID for the allowed application.
      type: String
    - contextPath: SophosCentral.BlockedItem.certificateSigner
      description: The value saved for the certificateSigner.
      type: String
    - contextPath: SophosCentral.BlockedItem.fileName
      description: The file name.
      type: String
    - contextPath: SophosCentral.BlockedItem.path
      description: The path for the application.
      type: String
    - contextPath: SophosCentral.BlockedItem.sha256
      description: The SHA256 value for the application.
      type: String
    - contextPath: SophosCentral.BlockedItem.type
      description: The property by which an item is allowed.
      type: String
    - contextPath: SophosCentral.BlockedItem.updatedAt
      description: Date and time (UTC) when the allowed application was updated.
      type: Date
    - contextPath: SophosCentral.BlockedItem.originEndpointId
      description: ID of the originating endpoint.
      type: String
    - contextPath: SophosCentral.BlockedItem.originPersonId
      description: ID of the originating person.
      type: String
    - contextPath: SophosCentral.BlockedItem.originPersonName
      description: Name of the originating person.
      type: String
  - arguments:
    - description: Comment indicating why the item should be blocked.
      name: comment
      required: true
    - description: The value saved for the certificateSigner.
      name: certificate_signer
    - description: The file name.
      name: file_name
    - description: The path for the application.
      name: path
    - description: The SHA256 value for the application.
      name: sha256
      required: true
    - auto: PREDEFINED
      description: The property by which an item is blocked. Possible value is sha256.
      name: item_type
      predefined:
      - sha256
      required: true
    description: Add a new blocked item.
    name: sophos-central-blocked-item-add
    outputs:
    - contextPath: SophosCentral.BlockedItem.comment
      description: A comment indicating why the item was allowed.
      type: String
    - contextPath: SophosCentral.BlockedItem.createdAt
      description: Date and time (UTC) when the allowed application was created.
      type: Date
    - contextPath: SophosCentral.BlockedItem.createdById
      description: The unique ID for the user who created the item.
      type: String
    - contextPath: SophosCentral.BlockedItem.createdByName
      description: The name for the user who created the item.
      type: String
    - contextPath: SophosCentral.BlockedItem.id
      description: The unique ID for the allowed application.
      type: String
    - contextPath: SophosCentral.BlockedItem.certificateSigner
      description: The value saved for the certificateSigner.
      type: String
    - contextPath: SophosCentral.BlockedItem.fileName
      description: The file name.
      type: String
    - contextPath: SophosCentral.BlockedItem.path
      description: The path for the application.
      type: String
    - contextPath: SophosCentral.BlockedItem.sha256
      description: The SHA256 value for the application.
      type: String
    - contextPath: SophosCentral.BlockedItem.type
      description: The property by which an item is allowed.
      type: String
    - contextPath: SophosCentral.BlockedItem.updatedAt
      description: Date and time (UTC) when the allowed application was updated.
      type: Date
    - contextPath: SophosCentral.BlockedItem.originEndpointId
      description: ID of the originating endpoint.
      type: String
    - contextPath: SophosCentral.BlockedItem.originPersonId
      description: ID of the originating person.
      type: String
    - contextPath: SophosCentral.BlockedItem.originPersonName
      description: Name of the originating person.
      type: String
  - arguments:
    - description: The blocked item ID.
      name: blocked_item_id
      required: true
    description: Delete an existing blocked item.
    name: sophos-central-blocked-item-delete
    outputs:
    - contextPath: SophosCentral.DeletedBlockedItem.deletedItemId
      description: The ID of the deleted item.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: 'Scan exclusion type. Possible values are: "path", "posixPath", "virtualPath", "process", "web", "pua", "exploitMitigation", "amsi", "behavioral".'
      name: exclusion_type
      predefined:
      - path
      - posixPath
      - virtualPath
      - process
      - web
      - pua
      - exploitMitigation
      - amsi
      - behavioral
    - defaultValue: '50'
      description: The maximum size of the page requested. Default is "50". Maximum is "100".
      name: page_size
    - defaultValue: '1'
      description: The page number to fetch. Default is "1".
      name: page
    description: List all scan exclusions.
    name: sophos-central-scan-exclusion-list
    outputs:
    - contextPath: SophosCentral.ScanExclusion.comment
      description: A comment indicating why the exclusion was updated.
      type: String
    - contextPath: SophosCentral.ScanExclusion.description
      description: The exclusion description added by the system.
      type: String
    - contextPath: SophosCentral.ScanExclusion.id
      description: The unique ID for the scanning exclusion setting.
      type: String
    - contextPath: SophosCentral.ScanExclusion.scanMode
      description: The scan mode. Default is "onDemandAndOnAccess" for exclusions of type path, posixPath, and virtualPath and "onAccess" for process, web, pua, amsi. Behavioral and Detected Exploits (exploitMitigation) type exclusions do not support a scan mode.
      type: String
    - contextPath: SophosCentral.ScanExclusion.type
      description: The scanning exclusion type.
      type: String
    - contextPath: SophosCentral.ScanExclusion.value
      description: The exclusion value.
      type: String
  - arguments:
    - description: The exclusion ID.
      name: exclusion_id
      required: true
    description: Get a single scan exclusion by ID.
    name: sophos-central-scan-exclusion-get
    outputs:
    - contextPath: SophosCentral.ScanExclusion.comment
      description: A comment indicating why the exclusion was updated.
      type: String
    - contextPath: SophosCentral.ScanExclusion.description
      description: The exclusion description added by the system.
      type: String
    - contextPath: SophosCentral.ScanExclusion.id
      description: The unique ID for the scanning exclusion setting.
      type: String
    - contextPath: SophosCentral.ScanExclusion.scanMode
      description: The scan mode. Default is "onDemandAndOnAccess" for exclusions of type path, posixPath, and virtualPath and "onAccess" for process, web, pua, amsi. Behavioral and Detected Exploits (exploitMitigation) type exclusions do not support a scan mode.
      type: String
    - contextPath: SophosCentral.ScanExclusion.type
      description: The scanning exclusion type.
      type: String
    - contextPath: SophosCentral.ScanExclusion.value
      description: The exclusion value.
      type: String
  - arguments:
    - description: A comment indicating why the exclusion was created.
      name: comment
    - auto: PREDEFINED
      description: 'The scan mode. Possible values are: "onDemand", "onAccess", and "onDemandAndOnAccess". Default is "onDemandAndOnAccess" for exclusions of type path, posixPath and virtualPath, "onAccess" for process, web, pua, amsi. Behavioral and Detected Exploits (exploitMitigation) type exclusions do not support a scan mode.'
      name: scan_mode
      predefined:
      - onDemand
      - onAccess
      - onDemandAndOnAccess
    - auto: PREDEFINED
      description: 'The scanning exclusion type. Possible values are: "path", "posixPath", "virtualPath", "process", "web", "pua", "exploitMitigation", "amsi", "behavioral".'
      name: exclusion_type
      predefined:
      - path
      - posixPath
      - virtualPath
      - process
      - web
      - pua
      - detectedExploit
      - amsi
      - behavioral
      required: true
    - description: The exclusion value.
      name: value
      required: true
    description: Add a new scan exclusion.
    name: sophos-central-scan-exclusion-add
    outputs:
    - contextPath: SophosCentral.ScanExclusion.comment
      description: A comment indicating why the exclusion was updated.
      type: String
    - contextPath: SophosCentral.ScanExclusion.description
      description: The exclusion description added by the system.
      type: String
    - contextPath: SophosCentral.ScanExclusion.id
      description: The unique ID for the scanning exclusion setting.
      type: String
    - contextPath: SophosCentral.ScanExclusion.scanMode
      description: The scan mode. Default is "onDemandAndOnAccess" for exclusions of type path, posixPath, and virtualPath and "onAccess" for process, web, pua, amsi. Behavioral and Detected Exploits (exploitMitigation) type exclusions do not support a scan mode.
      type: String
    - contextPath: SophosCentral.ScanExclusion.type
      description: The scanning exclusion type.
      type: String
    - contextPath: SophosCentral.ScanExclusion.value
      description: The exclusion value.
      type: String
  - arguments:
    - description: A comment indicating why the exclusion was created.
      name: comment
    - auto: PREDEFINED
      description: 'The scan mode. Possible values are: "onDemand", "onAccess", and "onDemandAndOnAccess". Default is "onDemandAndOnAccess" for exclusions of type path, posixPath and virtualPath, "onAccess" for process, web, pua, amsi. Behavioral and Detected Exploits (exploitMitigation) type exclusions do not support a scan mode.'
      name: scan_mode
      predefined:
      - onDemand
      - onAccess
      - onDemandAndOnAccess
    - description: The exclusion ID.
      name: exclusion_id
      required: true
    - description: The exclusion value.
      name: value
    description: Update an existing scan exclusion.
    name: sophos-central-scan-exclusion-update
    outputs:
    - contextPath: SophosCentral.ScanExclusion.comment
      description: A comment indicating why the exclusion was updated.
      type: String
    - contextPath: SophosCentral.ScanExclusion.description
      description: The exclusion description added by the system.
      type: String
    - contextPath: SophosCentral.ScanExclusion.id
      description: The unique ID for the scanning exclusion setting.
      type: String
    - contextPath: SophosCentral.ScanExclusion.scanMode
      description: The scan mode. Default is "onDemandAndOnAccess" for exclusions of type path, posixPath, and virtualPath and "onAccess" for process, web, pua, amsi. Behavioral and Detected Exploits (exploitMitigation) type exclusions do not support a scan mode.
      type: String
    - contextPath: SophosCentral.ScanExclusion.type
      description: The scanning exclusion type.
      type: String
    - contextPath: SophosCentral.ScanExclusion.value
      description: The exclusion value.
      type: String
  - arguments:
    - description: The exclusion ID.
      isArray: true
      name: exclusion_id
      required: true
    description: Delete an existing scan exclusion.
    name: sophos-central-scan-exclusion-delete
    outputs:
    - contextPath: SophosCentral.DeletedScanExclusion.deletedExclusionId
      description: The ID of the deleted exclusion.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: 'Exploit mitigation type. Possible values are: "detected" and "custom".'
      name: mitigation_type
      predefined:
      - detected
      - custom
    - defaultValue: '50'
      description: The maximum size of the page requested. Default is "50". Maximum is "100".
      name: page_size
    - defaultValue: '1'
      description: The page number to fetch. Default is "1".
      name: page
    - auto: PREDEFINED
      description: 'Whether the Exploit Mitigation application has been customized. Possible values are: "true" and "false".'
      name: modified
      predefined:
      - 'true'
      - 'false'
    description: List exploit mitigation settings for all protected applications.
    name: sophos-central-exploit-mitigation-list
    outputs:
    - contextPath: SophosCentral.ExploitMitigation.category
      description: The exploit mitigation category ID.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.name
      description: The name given to this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.id
      description: The ID of this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.paths
      description: Paths included in this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.type
      description: Whether the application was detected by the system or created by the user.
      type: String
  - arguments:
    - description: The Exploit Mitigation application ID.
      name: mitigation_id
      required: true
    description: Get Exploit Mitigation settings for a single application.
    name: sophos-central-exploit-mitigation-get
    outputs:
    - contextPath: SophosCentral.ExploitMitigation.category
      description: The Exploit Mitigation category ID.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.name
      description: The name given to this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.id
      description: The ID of this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.paths
      description: Paths included in this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.type
      description: Whether the application was detected by the system or created by the user.
      type: String
  - arguments:
    - description: An absolute path to an application file to exclude. You may use HitmanPro.Alert expansion variables (e.g., $desktop, $programfiles).
      name: path
      required: true
    description: Exclude a set of file paths from exploit mitigation.
    name: sophos-central-exploit-mitigation-add
    outputs:
    - contextPath: SophosCentral.ExploitMitigation.category
      description: The Exploit Mitigation category ID.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.name
      description: The name given to this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.id
      description: The ID of this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.paths
      description: Paths included in this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.type
      description: Whether the application was detected by the system or created by the user.
      type: String
  - arguments:
    - description: The Exploit Mitigation application ID.
      name: mitigation_id
      required: true
    - description: An absolute path to an application file to exclude. You may use HitmanPro.Alert expansion variables (e.g., $desktop, $programfiles).
      name: path
      required: true
    description: Update Exploit Mitigation settings for an application.
    name: sophos-central-exploit-mitigation-update
    outputs:
    - contextPath: SophosCentral.ExploitMitigation.category
      description: The Exploit Mitigation category ID.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.name
      description: The name given to this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.id
      description: The ID of this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.paths
      description: Paths included in this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.ExploitMitigation.type
      description: Whether the application was detected by the system or created by the user.
      type: String
  - arguments:
    - description: The Exploit Mitigation application ID.
      name: mitigation_id
      required: true
    description: Delete a custom (user-defined) Exploit Mitigation application by ID.
    name: sophos-central-exploit-mitigation-delete
    outputs:
    - contextPath: SophosCentral.DeletedExploitMitigation.deletedMitigationId
      description: The ID of the deleted mitigation.
      type: String
  - arguments:
    - defaultValue: '50'
      description: The maximum size of the page requested. Default is "50". Maximum is "100".
      name: page_size
    - defaultValue: '1'
      description: The page number to fetch. Default is "1".
      name: page
    - description: Filter out detected exploits with these thumbprints.
      name: thumbprint_not_in
    description: List all detected exploits.
    name: sophos-central-detected-exploit-list
    outputs:
    - contextPath: SophosCentral.DetectedExploit.count
      description: The number of times the same exploit has been detected, potentially across multiple endpoints.
      type: Number
    - contextPath: SophosCentral.DetectedExploit.description
      description: The English description of the exploit detected event.
      type: String
    - contextPath: SophosCentral.DetectedExploit.id
      description: The ID of this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.DetectedExploit.firstSeenAt
      description: When the exploit was first seen.
      type: Date
    - contextPath: SophosCentral.DetectedExploit.lastSeenAt
      description: When the exploit was last seen.
      type: Date
    - contextPath: SophosCentral.DetectedExploit.lastEndpointHostname
      description: The endpoint hostname.
      type: String
    - contextPath: SophosCentral.DetectedExploit.lastEndpointId
      description: The unique endpoint ID.
      type: String
    - contextPath: SophosCentral.DetectedExploit.lastUserName
      description: Person's name.
      type: String
    - contextPath: SophosCentral.DetectedExploit.lastUserId
      description: The unique ID for the user.
      type: String
    - contextPath: SophosCentral.DetectedExploit.thumbprint
      description: Matches [0-9a-zA-Z]{64}.
      type: String
  - arguments:
    - description: The ID of a previously detected exploit.
      name: detected_exploit_id
      required: true
    description: Get a single detected exploit.
    name: sophos-central-detected-exploit-get
    outputs:
    - contextPath: SophosCentral.DetectedExploit.count
      description: The number of times the same exploit has been detected, potentially across multiple endpoints.
      type: Number
    - contextPath: SophosCentral.DetectedExploit.description
      description: The English description of the exploit detected event.
      type: String
    - contextPath: SophosCentral.DetectedExploit.id
      description: The ID of this Exploit Mitigation application.
      type: String
    - contextPath: SophosCentral.DetectedExploit.firstSeenAt
      description: When the exploit was first seen.
      type: Date
    - contextPath: SophosCentral.DetectedExploit.lastSeenAt
      description: When the exploit was last seen.
      type: Date
    - contextPath: SophosCentral.DetectedExploit.lastEndpointHostname
      description: The endpoint hostname.
      type: String
    - contextPath: SophosCentral.DetectedExploit.lastEndpointId
      description: The unique endpoint ID.
      type: String
    - contextPath: SophosCentral.DetectedExploit.lastUserName
      description: Person's name.
      type: String
    - contextPath: SophosCentral.DetectedExploit.lastUserId
      description: The unique ID for the user.
      type: String
    - contextPath: SophosCentral.DetectedExploit.thumbprint
      description: Matches [0-9a-zA-Z]{64}.
      type: String
  - arguments:
    - description: The endpoint ID(s).
      isArray: true
      name: endpoint_id
      required: true
    - description: Comment indicating why the endpoint(s) should be isolated.
      name: comment
    description: Initiate isolation request on the endpoint(s).
    name: sophos-central-isolate-endpoint
    outputs:
    - contextPath: SophosCentral.EndpointIsolation.items.id
      description: 'The unique endpoint ID.'
      type: String
    - contextPath: SophosCentral.EndpointIsolation.items.isolation.enabled
      description: 'Isolation status.'
      type: Boolean
    - contextPath: SophosCentral.EndpointIsolation.items.isolation.lastEnabledAt
      description: 'When isolation was last enabled for the endpoint.'
      type: String
    - contextPath: SophosCentral.EndpointIsolation.items.isolation.lastEnabledBy.id
      description: 'Principal Email or clientId by whom isolation was enabled.'
      type: String
    - contextPath: SophosCentral.EndpointIsolation.items.isolation.lastDisabledAt
      description: 'When isolation was last disabled for the endpoint.'
      type: String
    - contextPath: SophosCentral.EndpointIsolation.items.isolation.lastDisabledBy.id
      description: 'Principal Email or clientId by whom isolation was disabled.'
      type: String
    - contextPath: SophosCentral.EndpointIsolation.items.isolation.comment
      description: 'Reason endpoint should be isolated or not.'
      type: String
  - arguments:
    - description: The endpoint ID(s).
      isArray: true
      name: endpoint_id
      required: true
    - description: Comment indicating why the endpoint(s) should be de-isolated.
      name: comment
    description: Initiate de-isolation request on the endpoint(s).
    name: sophos-central-deisolate-endpoint
    outputs:
    - contextPath: SophosCentral.EndpointIsolation.items.id
      description: 'The unique endpoint ID.'
      type: String
    - contextPath: SophosCentral.EndpointIsolation.items.isolation.enabled
      description: 'Isolation status.'
      type: Boolean
    - contextPath: SophosCentral.EndpointIsolation.items.isolation.lastEnabledAt
      description: 'When isolation was last enabled for the endpoint.'
      type: String
    - contextPath: SophosCentral.EndpointIsolation.items.isolation.lastEnabledBy.id
      description: 'Principal Email or clientId by whom isolation was enabled.'
      type: String
    - contextPath: SophosCentral.EndpointIsolation.items.isolation.lastDisabledAt
      description: 'When isolation was last disabled for the endpoint.'
      type: String
    - contextPath: SophosCentral.EndpointIsolation.items.isolation.lastDisabledBy.id
      description: 'Principal Email or clientId by whom isolation was disabled.'
      type: String
    - contextPath: SophosCentral.EndpointIsolation.items.isolation.comment
      description: 'Reason endpoint should be isolated or not.'
      type: String
  - arguments:
    - description: Comma separated list of group UUIDs.
      isArray: true
      name: groupsIds
    - description: Search for items that match the given terms.
      name: search
    - description: 'Search only within the allowed comma-separated field values. When not specified, the default behavior is to search group by names only. The following are Group fields values allowed to be searched: name, description.'
      name: searchFields
    - description: List the items that match the given domain.
      name: domain
    - description: Types of sources of directory information. All users and groups created using this API have the source type custom. All users and groups synced from Active Directory or Entra ID have the source type activeDirectory or azureActiveDirectory. The following values are allowed:- custom, activeDirectory, azureActiveDirectory.
      name: sourceType
      predefined:
      - custom
      - activeDirectory
      - azureActiveDirectory
    - description: Search groups associated with the given user ID.
      name: userId
    - defaultValue: 1
      description: The page number to fetch. Default is "1".
      name: page
    - defaultValue: 50
      description: Size of the page requested. Default is "50". Maximum is "100".
      name: pageSize
    description: Returns a list of all user groups that match the search criteria (optional).
    name: sophos-central-usergroups-list
    outputs:
    - contextPath: SophosCentral.UserGroups.id
      description: 'Group ID.'
      type: String
    - contextPath: SophosCentral.UserGroups.name
      description: 'Group name.'
      type: String
    - contextPath: SophosCentral.UserGroups.displayName
      description: 'Group display name.'
      type: String
    - contextPath: SophosCentral.UserGroups.description
      description: 'Group description.'
      type: String
    - contextPath: SophosCentral.UserGroups.groups.total
      description: 'Total Count of groups.'
      type: Number
    - contextPath: SophosCentral.UserGroups.groups.itemsCount
      description: 'Count of items.'
      type: Number
    - contextPath: SophosCentral.UserGroups.source.type
      description: "Types of sources of directory information. All users and groups created using this API have the source type custom. All users and groups synced from Active Directory or Entra ID have the source type activeDirectory or azureActiveDirectory. The following values are allowed: custom, activeDirectory, azureActiveDirectory."
      type: String
    - contextPath: SophosCentral.UserGroups.usersTotal
      description: 'Total count of users.'
      type: Number
    - contextPath: SophosCentral.UserGroups.usersItemsCount
      description: 'Count of items.'
      type: Number
    - contextPath: SophosCentral.UserGroups.users.id
      description: 'User ID.'
      type: String
    - contextPath: SophosCentral.UserGroups.users.name
      description: 'User Name.'
      type: String
    - contextPath: SophosCentral.UserGroups.tenant.id
      description: 'Tenant ID.'
      type: String
    - contextPath: SophosCentral.UserGroups.createdAt
      description: 'When the group was created.'
      type: Date
    - contextPath: SophosCentral.UserGroups.updatedAt
      description: 'When the group was last updated.'
      type: Date
  - arguments:
    - description: Unique ID of the group whose details to be retrieved (You can retrieve the group ID from the sophos-central-usergroups-list).
      name: groupId
      required: true
    description: Returns the details of the GroupID specified.
    name: sophos-central-usergroups-get
    outputs:
    - contextPath: SophosCentral.UserGroups.id
      description: 'Group ID.'
      type: String
    - contextPath: SophosCentral.UserGroups.name
      description: 'Group name.'
      type: String
    - contextPath: SophosCentral.UserGroups.displayName
      description: 'Group display name.'
      type: String
    - contextPath: SophosCentral.UserGroups.description
      description: 'Group description.'
      type: String
    - contextPath: SophosCentral.UserGroups.groups.total
      description: 'Count of total groups.'
      type: Number
    - contextPath: SophosCentral.UserGroups.groups.itemsCount
      description: 'Count of items.'
      type: Number
    - contextPath: SophosCentral.UserGroups.source.type
      description: 'Types of sources of directory information. All users and groups created using this API have the source type custom. All users and groups synced from Active Directory or Entra ID have the source type activeDirectory or azureActiveDirectory. The following values are allowed: custom, activeDirectory, azureActiveDirectory.'
      type: String
    - contextPath: SophosCentral.UserGroups.usersTotal
      description: 'Total count of users.'
      type: Number
    - contextPath: SophosCentral.UserGroups.usersItemsCount
      description: 'Count of items.'
      type: Number
    - contextPath: SophosCentral.UserGroups.users.id
      description: 'User ID.'
      type: String
    - contextPath: SophosCentral.UserGroups.users.name
      description: 'User Name.'
      type: String
    - contextPath: SophosCentral.UserGroups.tenant.id
      description: 'Tenant ID.'
      type: String
    - contextPath: SophosCentral.UserGroups.createdAt
      description: 'When the group was created.'
      type: Date
    - contextPath: SophosCentral.UserGroups.updatedAt
      description: 'When the group was last updated.'
      type: Date
  - arguments:
    - description: Provide a unique name of the group to create a usergroup in a directory.
      name: groupName
      required: true
    - description: Description of the user group.
      name: description
    - description: Comma-separated list of User UUIDs. Maximum 1000 unique User IDs are allowed (You can retrieve the userIds from the sophos-central-users-list).
      isArray: true
      name: userIds
    description: Creates a new “custom” (Centrally Managed) Group.
    name: sophos-central-usergroups-create
    outputs:
    - contextPath: SophosCentral.UserGroups.id
      description: 'Group ID.'
      type: String
    - contextPath: SophosCentral.UserGroups.name
      description: 'Group name.'
      type: String
    - contextPath: SophosCentral.UserGroups.displayName
      description: 'Group display name.'
      type: String
    - contextPath: SophosCentral.UserGroups.description
      description: 'Group description.'
      type: String
    - contextPath: SophosCentral.UserGroups.groups.total
      description: 'Total count of groups.'
      type: Number
    - contextPath: SophosCentral.UserGroups.groups.itemsCount
      description: 'Count of items.'
      type: Number
    - contextPath: SophosCentral.UserGroups.source.type
      description: 'Types of sources of directory information. All users and groups created using this API have the source type custom. All users and groups synced from Active Directory or Entra ID have the source type activeDirectory or azureActiveDirectory. The following values are allowed: custom, activeDirectory, azureActiveDirectory.'
      type: String
    - contextPath: SophosCentral.UserGroups.usersTotal
      description: 'Total count of users.'
      type: Number
    - contextPath: SophosCentral.UserGroups.usersItemsCount
      description: 'Count of items.'
      type: Number
    - contextPath: SophosCentral.UserGroups.users.id
      description: 'User ID.'
      type: String
    - contextPath: SophosCentral.UserGroups.users.name
      description: 'User Name.'
      type: String
    - contextPath: SophosCentral.UserGroups.tenant.id
      description: 'Tenant ID.'
      type: String
    - contextPath: SophosCentral.UserGroups.createdAt
      description: 'When the group was created.'
      type: Date
    - contextPath: SophosCentral.UserGroups.updatedAt
      description: 'When the group was last updated.'
      type: Date
  - arguments:
    - description: Unique ID of the group whose details to be updated (You can retrieve the group ID from the sophos-central-usergroups-list).
      name: groupId
      required: true
    - description: Group Name.
      name: groupName
      required: true
    - description: Group Description.
      name: description
    description: Allows for the editing of the group name and description for a usergroup.
    name: sophos-central-usergroups-update
    outputs:
    - contextPath: SophosCentral.UserGroups.id
      description: 'Group ID.'
      type: String
    - contextPath: SophosCentral.UserGroups.name
      description: 'Group name.'
      type: String
    - contextPath: SophosCentral.UserGroups.displayName
      description: 'Group display name.'
      type: String
    - contextPath: SophosCentral.UserGroups.description
      description: 'Group description.'
      type: String
    - contextPath: SophosCentral.UserGroups.groups.total
      description: 'Total count of groups.'
      type: Number
    - contextPath: SophosCentral.UserGroups.groups.itemsCount
      description: 'Count of items.'
      type: Number
    - contextPath: SophosCentral.UserGroups.source.type
      description: 'Types of sources of directory information. All users and groups created using this API have the source type custom. All users and groups synced from Active Directory or Entra ID have the source type activeDirectory or azureActiveDirectory. The following values are allowed: custom, activeDirectory, azureActiveDirectory.'
      type: String
    - contextPath: SophosCentral.UserGroups.usersTotal
      description: 'Total count of users.'
      type: Number
    - contextPath: SophosCentral.UserGroups.usersItemsCount
      description: 'Count of items.'
      type: Number
    - contextPath: SophosCentral.UserGroups.users.id
      description: 'User ID.'
      type: String
    - contextPath: SophosCentral.UserGroups.users.name
      description: 'User Name.'
      type: String
    - contextPath: SophosCentral.UserGroups.tenant.id
      description: 'Tenant ID.'
      type: String
    - contextPath: SophosCentral.UserGroups.createdAt
      description: 'When the group was created.'
      type: Date
    - contextPath: SophosCentral.UserGroups.updatedAt
      description: 'When the group was last updated.'
      type: Date
  - arguments:
    - description: Unique id of the usergroup to be deleted. Users in the usergroup should be removed first in order to delete the usergroup (You can retrieve the group ID from the sophos-central-usergroups-list).
      name: groupId
      required: true
    description: Deletes the specified group.
    name: sophos-central-usergroups-delete
    outputs:
    - contextPath: SophosCentral.DeletedUserGroups.deletedUserGroupId
      description: 'Deleted Group ID.'
      type: String
  - arguments:
    - description: Group name.
      name: name
      required: true
    - description: Group description.
      name: description
    - auto: PREDEFINED
      description: 'Group type. The following values are allowed: computer, server.'
      name: type
      required: true
      predefined:
      - server
      - computer
    - description: Comma-separated list of endpoint IDs. (You can retrieve endpoint IDs from sophos-central-endpoint-list command).
      isArray: true
      name: endpointIds
    description: Create a new endpoint group.
    name: sophos-central-group-create
    outputs:
    - contextPath: SophosCentral.EndpointGroups.id
      description: 'Group ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.name
      description: 'Group name.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.description
      description: 'Group description.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.type
      description: 'Endpoint group types.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.endpoints.total
      description: 'Total number of endpoints in this group.'
      type: Number
    - contextPath: SophosCentral.EndpointGroups.endpoints.itemsCount
      description: 'Total number of items in the list.'
      type: Number
    - contextPath: SophosCentral.EndpointGroups.tenant.id
      description: 'Tenant ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.createdAt
      description: 'When the group was created.'
      type: Date
  - arguments:
    - description: Group name.
      name: name
    - description: Group description.
      name: description
    - description: UUID of Endpoint group ID.
      name: groupId
      required: true
    description: Update an endpoint group.
    name: sophos-central-group-update
    outputs:
    - contextPath: SophosCentral.EndpointGroups.id
      description: 'Group ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.name
      description: 'Group name.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.description
      description: 'Group description.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.type
      description: 'Endpoint group types.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.endpoints.total
      description: 'Total number of endpoints in this group.'
      type: Number
    - contextPath: SophosCentral.EndpointGroups.endpoints.itemsCount
      description: 'Total number of items in the list.'
      type: Number
    - contextPath: SophosCentral.EndpointGroups.tenant.id
      description: 'Tenant ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.createdAt
      description: 'When the group was created.'
      type: Date
    - contextPath: SophosCentral.EndpointGroups.updatedAt
      description: 'When the group was updated.'
      type: Date
  - arguments:
    - description: UUID of Endpoint group ID.
      name: groupId
      required: true
    description: Get an endpoint group by ID.
    name: sophos-central-group-get
    outputs:
    - contextPath: SophosCentral.EndpointGroups.id
      description: 'Group ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.name
      description: 'Group name.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.description
      description: 'Group description.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.type
      description: 'Endpoint group types.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.endpoints.total
      description: 'Total number of endpoints in this group.'
      type: Number
    - contextPath: SophosCentral.EndpointGroups.endpoints.itemsCount
      description: 'Total number of items in the list.'
      type: Number
    - contextPath: SophosCentral.EndpointGroups.tenant.id
      description: 'Tenant ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.createdAt
      description: 'When the group was created.'
      type: Date
    - contextPath: SophosCentral.EndpointGroups.updatedAt
      description: 'When the group was updated.'
      type: Date
  - arguments:
    - description: UUID of Endpoint group ID.(You can retrieve endpoint group-id from sophos-central-group-list command).
      name: groupId
      required: true
    description: Get endpoints in a group.
    name: sophos-central-group-membership-get
    outputs:
    - contextPath: SophosCentral.EndpointGroups.id
      description: 'Group ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.type
      description: 'Endpoint group types.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.tenant.id
      description: 'Tenant ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.hostname
      description: 'Hostname of the endpoint.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.os.isServer
      description: 'Whether the OS is a server OS.'
      type: Boolean
    - contextPath: SophosCentral.EndpointGroups.os.platform
      description: 'OS platform type.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.os.name
      description: 'OS name as reported by the endpoint.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.os.majorVersion
      description: 'OS major version.'
      type: Number
    - contextPath: SophosCentral.EndpointGroups.os.minorVersion
      description: 'OS minor version.'
      type: Number
    - contextPath: SophosCentral.EndpointGroups.os.build
      description: 'OS build.'
      type: Number
    - contextPath: SophosCentral.EndpointGroups.ipv4Addresses
      description: 'List of IPv4 addresses.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.ipv6Addresses
      description: 'List of IPv6 addresses.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.macAddresses
      description: 'List of MAC addresses.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.group.name
      description: 'Endpoint group name.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.group.id
      description: 'Unique ID for endpoint group.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.associatedPerson.name
      description: "Person's name."
      type: String
    - contextPath: SophosCentral.EndpointGroups.associatedPerson.viaLogin
      description: "Person's login on the endpoint."
      type: String
    - contextPath: SophosCentral.EndpointGroups.associatedPerson.id
      description: 'Unique ID for endpoint group.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.tamperProtectionEnabled
      description: 'Whether Tamper Protection is turned on.'
      type: Boolean
    - contextPath: SophosCentral.EndpointGroups.lastSeenAt
      description: 'Date and time (UTC) when the endpoint last communicated with Sophos Central.'
      type: Date
  - arguments:
    - description: UUID of Endpoint group ID.(You can retrieve endpoint group-id from sophos-central-group-list command).
      name: groupId
      required: true
    - description: Comma-separated list of endpoint IDs. (You can retrieve endpoint IDs from sophos-central-endpoint-list command).
      isArray: true
      name: endpointIds
      required: true
    description: Add endpoints in a group.
    name: sophos-central-group-endpoints-add
    outputs:
    - contextPath: SophosCentral.EndpointGroups.endpoints.id
      description: 'Unique endpoint ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.endpoints.hostname
      description: 'Endpoint hostname.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.id
      description: 'Unique group ID.'
      type: String
  - arguments:
    - description: UUID of Endpoint group ID.(You can retrieve endpoint group-id from sophos-central-group-list command).
      name: groupId
      required: true
    - description: Comma-separated list of endpoint IDs. (You can retrieve endpoint IDs from sophos-central-endpoint-list command).
      isArray: true
      name: endpointIds
      required: true
    description: Remove endpoints from a group.
    name: sophos-central-group-endpoints-remove
    outputs:
    - contextPath: SophosCentral.EndpointGroups.endpoints.id
      description: 'Unique endpoint ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.endpoints.hostname
      description: 'Endpoint hostname.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.id
      description: 'Unique group ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.removedEndpoints
      description: 'List of removed EndpointIds from the group.'
      type: String
  - arguments:
    - description: UUID of Endpoint group ID.(You can retrieve endpoint group-id from sophos-central-group-list command).
      name: groupId
      required: true
    - description: Comma-separated list of endpoint IDs. (You can retrieve endpoint IDs from sophos-central-endpoint-list command).
      name: endpointId
      required: true
    description: Remove endpoint from a group.
    name: sophos-central-group-endpoint-remove
    outputs:
    - contextPath: SophosCentral.EndpointGroups.removedEndpoint
      description: 'EndpointId of removed endpoint.'
      type: Boolean
    - contextPath: SophosCentral.EndpointGroups.id
      description: 'Group Id.'
      type: String
  - arguments:
    - defaultValue: '50'
      description: The maximum size of the page requested. Default is "50". Maximum is "1000".
      name: page_size
    - defaultValue: '1'
      description: Page number to return. Default is "1".
      name: page
    description: List endpoint groups.
    name: sophos-central-group-list
    outputs:
    - contextPath: SophosCentral.EndpointGroups.id
      description: 'Group ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.name
      description: 'Group name.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.type
      description: 'Endpoint group types.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.endpoints.total
      description: 'Total number of endpoints in this group.'
      type: Number
    - contextPath: SophosCentral.EndpointGroups.endpoints.itemsCount
      description: 'Total number of items in the list.'
      type: Number
    - contextPath: SophosCentral.EndpointGroups.tenant.id
      description: 'Tenant ID.'
      type: String
    - contextPath: SophosCentral.EndpointGroups.createdAt
      description: 'When the group was created.'
      type: Date
    - contextPath: SophosCentral.EndpointGroups.description
      description: 'Group description.'
      type: String
  - arguments:
    - description: UUID of Endpoint group ID.(You can retrieve endpoint group-id from sophos-central-group-list command).
      name: groupId
      required: true
    description: Delete an endpoint group by ID.
    name: sophos-central-group-delete
    outputs:
    - contextPath: SophosCentral.EndpointGroups.deleted
      description: 'Endpoint group deleted.'
      type: Boolean
    - contextPath: SophosCentral.EndpointGroups.id
      description: 'Group Id.'
      type: String
  - arguments:
    - defaultValue: '50'
      description: The maximum size of the page requested. Default is "50". Maximum is "200".
      name: page_size
    - defaultValue: '1'
      description: Page number to return. Default is "1".
      name: page
    - auto: PREDEFINED
      description: 'Fetch the policies based on policy_type value. Possible values are: "threat-protection", "peripheral-control", "application-control", "data-loss-prevention", "device-encryption", "web-control", "agent-updating", "windows-firewall", "server-threat-protection", "server-peripheral-control", "server-application-control", "server-web-control", "server-lockdown", "server-data-loss-prevention", "server-agent-updating", "server-windows-firewall", "server-file-integrity-monitoring".'
      name: policy_type
      predefined:
      - threat-protection
      - peripheral-control
      - application-control
      - data-loss-prevention
      - device-encryption
      - web-control
      - agent-updating
      - windows-firewall
      - server-threat-protection
      - server-peripheral-control
      - server-application-control
      - server-web-control
      - server-lockdown
      - server-data-loss-prevention
      - server-agent-updating
      - server-windows-firewall
      - server-file-integrity-monitoring
    name: sophos-central-endpoint-policy-search
    description: Get all endpoint policy.
    outputs:
    - contextPath: SophosCentral.PolicyAndEnumeration.id
      description: 'Policy ID.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.feature
      description: 'Feature.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.settings
      description: 'Settings.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.orderPriority
      description: 'Order priority.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.name
      description: 'Name.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.enforced
      description: 'Enforced (T|F).'
      type: Boolean
    - contextPath: SophosCentral.PolicyAndEnumeration.typeSingle
      description: 'Type Single.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.typeGroup
      description: 'Type Group.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.lastModified
      description: 'Last Modified.'
      type: String
  - arguments:
    - description: The policy ID. You can find the policy_id by executing the `sophos-central-endpoint-policy-search` command.
      isArray: true
      name: policy_id
      required: true
    name: sophos-central-endpoint-policy-get
    description: Get details of Policy by id.
    outputs:
    - contextPath: SophosCentral.PolicyAndEnumeration.id
      description: 'Policy ID.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.feature
      description: 'Feature.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.settings
      description: 'Settings.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.orderPriority
      description: 'Order priority.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.name
      description: 'Name.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.enforced
      description: 'Enforced (T|F).'
      type: Boolean
    - contextPath: SophosCentral.PolicyAndEnumeration.typeSingle
      description: 'Type Single.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.typeGroup
      description: 'Type Group.'
      type: String
    - contextPath: SophosCentral.PolicyAndEnumeration.lastModified
      description: 'Last Modified.'
      type: String
  - arguments:
    - description: The policy ID. You can find the policy_id by executing the `sophos-central-endpoint-policy-search` command.
      isArray: true
      name: policy_id
      required: true
    - description: Policy name of the newly cloned policy.
      isArray: true
      name: name
    description: Clone an existing endpoint policy.
    name: sophos-central-endpoint-policy-clone
    outputs:
    - contextPath: SophosCentral.PolicyAndEnumeration.clonedPolicyId
      description: The ID of the cloned policy.
      type: String
  - arguments:
    - description: The policy ID. You can find the policy_id by executing the `sophos-central-endpoint-policy-search` command.
      isArray: true
      name: policy_id
      required: true
    - description: Update Policy Order priority for non-base policies.
      isArray: true
      name: priority
      required: true
    description: Update Policy priority for non-base policies.
    name: sophos-central-endpoint-policy-reorder
    outputs:
    - contextPath: SophosCentral.PolicyAndEnumeration.updatedPolicyId
      description: The ID of the updated policy.
      type: String
  - arguments:
    - description: The policy ID. You can find the policy_id by executing the `sophos-central-endpoint-policy-search` command.
      isArray: true
      name: policy_id
      required: true
    description: Delete an existing endpoint policy.
    name: sophos-central-endpoint-policy-search-delete
    outputs:
    - contextPath: SophosCentral.PolicyAndEnumeration.deletedPolicyId
      description: The ID of the deleted policy.
      type: String
  - arguments:
    - description: Unique UUID of Group.
      name: groupId
      required: true
    - description: Comma-separated list of User UUIDs. Maximum 1000 unique User IDs are allowed (You can retrieve the userIds from the sophos-central-users-list).
      isArray: true
      name: userIds
      required: true
    description: Add multiple users to the specified group.
    name: sophos-central-usergroups-users-add
    outputs:
    - contextPath: SophosCentral.UserGroups.id
      description: The Group ID.
      type: String
    - contextPath: SophosCentral.UserGroups.addedUsers.id
      description: User ID.
      type: String
    - contextPath: SophosCentral.UserGroups.addedUsers.name
      description: User's full name.
      type: String
  - arguments:
    - description: Unique UUID of Group (You can retrieve the group ID from the sophos-central-usergroups-list).
      name: groupId
      required: true
    - description: Unique UUID of User (You can retrieve the user ID from the sophos-central-users-list).
      name: userId
      required: true
    description: Remove a specific User from the group.
    name: sophos-central-usergroups-user-delete
    outputs:
    - contextPath: SophosCentral.UserGroups.id
      description: The Group ID.
      type: String
    - contextPath: SophosCentral.UserGroups.users.removedUser
      description: The User ID.
      type: String
  - arguments:
    - description: Unique Group UUID (You can retrieve the group ID from the sophos-central-usergroups-list).
      name: groupId
      required: true
    - description: Search for items that match the given terms.
      name: search
    - description: 'Search only within the specified comma-separated field values. The following values are allowed: name, firstName, lastName, email, exchangeLogin  When not specified, the default behavior is to search the full names of users, only.'
      name: searchFields
    - description: List the items that match the given domain.
      name: domain
    - description: 'Types of sources of directory information. The following values are allowed: custom, activeDirectory, azureActiveDirectory.'
      name: sourceType
      predefined:
      - custom
      - activeDirectory
      - azureActiveDirectory
    - defaultValue: 1
      description: The page number to fetch. Default is "1".
      name: page
    - defaultValue: 50
      description: Size of the page requested. Default is "50". Maximum is "100".
      name: pageSize
    description: List all users in a specific group.
    name: sophos-central-usergroups-membership-get
    outputs:
    - contextPath: SophosCentral.UserGroups.users.id
      description: User ID.
      type: String
    - contextPath: SophosCentral.UserGroups.users.name
      description: User's name.
      type: String
    - contextPath: SophosCentral.UserGroups.users.firstName
      description: User's first name or given name.
      type: String
    - contextPath: SophosCentral.UserGroups.users.lastName
      description: User's last name or surname.
      type: String
    - contextPath: SophosCentral.UserGroups.users.emailAddress
      description: User's email address.
      type: String
    - contextPath: SophosCentral.UserGroups.users.groups.total
      description: Total number of groups.
      type: number
    - contextPath: SophosCentral.UserGroups.users.groups.itemsCount
      description: Item count.
      type: number
    - contextPath: SophosCentral.UserGroups.users.groups.items.id
      description: Group ID.
      type: String
    - contextPath: SophosCentral.UserGroups.users.groups.items.name
      description: Group name.
      type: String
    - contextPath: SophosCentral.UserGroups.users.groups.items.displayName
      description: Group display name.
      type: String
    - contextPath: SophosCentral.UserGroups.users.groups.tenant.id
      description: Tenant ID.
      type: String
    - contextPath: SophosCentral.UserGroups.users.groups.source.type
      description: Types of sources of directory information.
      type: String
  - arguments:
    - defaultValue: "50"
      description: The maximum number of items to return. Default is "50". Maximum is "100".
      name: pageSize
    - defaultValue: "1"
      description: Page number to return. Default is "1".
      name: page
    - description: Search for items that match the given terms.
      name: search
    - description: 'Search only within the specified comma-seperated field values. The following values are allowed: name, firstName, lastName, email, exchangeLogin  When not specified, the default behavior is to search the full names of users, only.'
      name: searchFields
    - auto: PREDEFINED
      description: 'Types of sources of directory information. The following values are allowed: custom, activeDirectory, azureActiveDirectory.'
      name: sourceType
      predefined:
      - custom
      - activeDirectory
      - azureActiveDirectory
    - description: 'Search for users in a group that has this ID (You can get the group ID from sophos-central-usergroups-list command).'
      name: groupId
    - description: 'List the items that match the given domain.'
      name: domain
    description: List users for the given tenant.
    name: sophos-central-users-list
    outputs:
    - contextPath: SophosCentral.Users.id
      description: User ID.
      type: String
    - contextPath: SophosCentral.Users.name
      description: User's name.
      type: String
    - contextPath: SophosCentral.Users.firstName
      description: User's first name or given name.
      type: String
    - contextPath: SophosCentral.Users.lastName
      description: User's last name or surname.
      type: String
    - contextPath: SophosCentral.Users.email
      description: User's email address.
      type: String
    - contextPath: SophosCentral.Users.groups.total
      description: Total users.
      type: Number
    - contextPath: SophosCentral.Users.groups.itemsCount
      description: Total number of groups in which user is exists.
      type: Number
    - contextPath: SophosCentral.Users.groups.items.id
      description: Group ID.
      type: string
    - contextPath: SophosCentral.Users.groups.items.name
      description: Group name.
      type: string
    - contextPath: SophosCentral.Users.groups.items.displayName
      description: Group display name.
      type: string
    - contextPath: SophosCentral.Users.tenant.id
      description: Tenant ID.
      type: String
    - contextPath: SophosCentral.Users.source.type
      description: SourceType of the user.
      type: String
    - contextPath: SophosCentral.Users.createdAt
      description: When the user was created.
      type: Date
  - arguments:
    - name: userId
      description: Unique User UUID (You can get the user ID from sophos-central-users-list command).
      required: true
    description: List user with userId for the given tenant.
    name: sophos-central-users-get
    outputs:
    - contextPath: SophosCentral.Users.id
      description: User ID.
      type: String
    - contextPath: SophosCentral.Users.name
      description: User's name.
      type: String
    - contextPath: SophosCentral.Users.firstName
      description: User's first name or given name.
      type: String
    - contextPath: SophosCentral.Users.lastName
      description: User's last name or surname.
      type: String
    - contextPath: SophosCentral.Users.email
      description: User's email address.
      type: String
    - contextPath: SophosCentral.Users.groups.total
      description: Total users.
      type: Number
    - contextPath: SophosCentral.Users.groups.itemsCount
      description: Total number of groups in which user is exists.
      type: Number
    - contextPath: SophosCentral.Users.groups.items.id
      description: Group ID.
      type: string
    - contextPath: SophosCentral.Users.groups.items.name
      description: Group name.
      type: string
    - contextPath: SophosCentral.Users.groups.items.displayName
      description: Group display name.
      type: string
    - contextPath: SophosCentral.Users.tenant.id
      description: Tenant ID.
      type: String
    - contextPath: SophosCentral.Users.source.type
      description: SourceType of the user.
      type: String
    - contextPath: SophosCentral.Users.createdAt
      description: When the user was created.
      type: Date
    - contextPath: SophosCentral.Users.updatedAt
      description: When the user was updated.
      type: Date
  - arguments:
    - description: First Name of the user. This must not include a space. Maximum length should be 250 characters.
      name: firstName
      required: true
    - description: Last Name of the user. This must not include a space. Maximum length should be 250 characters.
      name: lastName
      required: true
    - description: Email Address of the user.
      name: email
      required: true
    - description: Exchange Login for the user.
      name: exchangeLogin
    - description: Comma-separated list of GroupIds to be enrolled in (You can get the list of user IDs from sophos-central-usergroups-list command).
      isArray: true
      name: groupIds
    description: Add a new user.
    name: sophos-central-users-add
    outputs:
    - contextPath: SophosCentral.Users.id
      description: User ID.
      type: String
    - contextPath: SophosCentral.Users.name
      description: User's name.
      type: String
    - contextPath: SophosCentral.Users.firstName
      description: User's first name or given name.
      type: String
    - contextPath: SophosCentral.Users.lastName
      description: User's last name or surname.
      type: String
    - contextPath: SophosCentral.Users.email
      description: User's email address.
      type: String
    - contextPath: SophosCentral.Users.groups.total
      description: Total users.
      type: Number
    - contextPath: SophosCentral.Users.groups.itemsCount
      description: Total number of groups in which user is exists.
      type: Number
    - contextPath: SophosCentral.Users.groups.items.id
      description: Group ID.
      type: string
    - contextPath: SophosCentral.Users.groups.items.name
      description: Group name.
      type: string
    - contextPath: SophosCentral.Users.groups.items.displayName
      description: Group display name.
      type: string
    - contextPath: SophosCentral.Users.tenant.id
      description: Tenant ID.
      type: String
    - contextPath: SophosCentral.Users.source.type
      description: SourceType of the user.
      type: String
    - contextPath: SophosCentral.Users.createdAt
      description: When the user was created.
      type: Date
    - contextPath: SophosCentral.Users.updatedAt
      description: When the user was updated.
      type: Date
  - arguments:
    - description: Unique User UUID (You can get the user ID from sophos-central-users-list command).
      name: userId
      required: true
    - description: User's fullname.
      name: name
    - description: First Name of the user. This must not include a space. Maximum length should be 250 characters.
      name: firstName
    - description: Last Name of the user. This must not include a space. Maximum length should be 250 characters.
      name: lastName
    - description: Email Address of the user.
      name: email
    - description: Exchange Login for the user.
      name: exchangeLogin
    description: Update a user.
    name: sophos-central-users-update
    outputs:
    - contextPath: SophosCentral.Users.id
      description: User ID.
      type: String
    - contextPath: SophosCentral.Users.name
      description: User's name.
      type: String
    - contextPath: SophosCentral.Users.firstName
      description: User's first name or given name.
      type: String
    - contextPath: SophosCentral.Users.lastName
      description: User's last name or surname.
      type: String
    - contextPath: SophosCentral.Users.email
      description: User's email address.
      type: String
    - contextPath: SophosCentral.Users.groups.total
      description: Total users.
      type: Number
    - contextPath: SophosCentral.Users.groups.itemsCount
      description: Total number of groups in which user is exists.
      type: Number
    - contextPath: SophosCentral.Users.groups.items.id
      description: Group ID.
      type: string
    - contextPath: SophosCentral.Users.groups.items.name
      description: Group name.
      type: string
    - contextPath: SophosCentral.Users.groups.items.displayName
      description: Group display name.
      type: string
    - contextPath: SophosCentral.Users.tenant.id
      description: Tenant ID.
      type: String
    - contextPath: SophosCentral.Users.source.type
      description: SourceType of the user.
      type: String
    - contextPath: SophosCentral.Users.createdAt
      description: When the user was created.
      type: Date
    - contextPath: SophosCentral.Users.updatedAt
      description: When the user was updated.
      type: Date
  - arguments:
    - description: Unique User UUID (You can get user ID from sophos-central-users-list command).
      name: userId
      required: true
    description: Delete a user.
    name: sophos-central-users-delete
    outputs:
    - contextPath: SophosCentral.DeletedUsers.deletedUserId
      description: Deleted User's Id.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 5.0.0