What problem does it solve? Working with the Sophos Central API requires juggling OAuth2 token flows, regional host resolution, partner/tenant header conventions, and inconsistent pagination styles across endpoints. This Skill encodes that entire workflow so you can query and manage your Sophos estate without re-reading API documentation each time. ## Core Features & Use Cases - Endpoint management: List and filter endpoints by health, isolate or de-isolate devices, trigger scans, and manage tamper protection via the Endpoint API. - Alert triage and SIEM export: Search and act on alerts through the Common API, and pull rolling event/alert feeds through the SIEM API for Splunk or Sentinel ingestion. - Threat hunting: Run XDR Data Lake SQL queries for historical hunts or Live Discover osquery against live devices, plus manage Central-registered firewalls and firmware. - Use Case: During incident response, ask to isolate all endpoints matching a hostname pattern — the Skill resolves the tenant region, finds the device IDs, shows you the target list, and bulk-isolates them with a ticket reference comment. ## Quick Start Ask the assistant to list all Sophos endpoints with bad or suspicious health status using your SOPHOS_CLIENT_ID and SOPHOS_CLIENT_SECRET environment variables.
