feat(sophos-central): new Sophos Central endpoint integration

Sophos Central Endpoint API, 7 commands: list/get endpoints, isolate/de-isolate (containment), scan, list alerts. OAuth2 client-credentials + tenant discovery (whoami), stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 15:04:02 +02:00
parent addaeadae5
commit 1949c98cf7
8 changed files with 674 additions and 0 deletions
@@ -0,0 +1,85 @@
+id: sophos_central
+name: Sophos Central
+version: 1.0.0
+description: "Sophos Central (Endpoint API) — endpoint containment: list and read endpoints, isolate/de-isolate a host, trigger a scan, and list alerts. OAuth2 client-credentials authentication (with tenant discovery); stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list/get endpoints, isolate/de-isolate, scan, list alerts."
+category: endpoint
+
+# Per-instance configuration. Client credentials are exchanged for a token; the
+# whoami endpoint provides the tenant ID and regional API host used thereafter.
+config_schema:
+  properties:
+    client_id:
+      type: string
+      description: "Sophos Central API client ID"
+    client_secret:
+      type: string
+      description: "Sophos Central API client secret"
+      x-soar-sensitive: true
+  required:
+    - client_id
+    - client_secret
+
+commands:
+  - id: list_endpoints
+    name: sophos-list-endpoints
+    description: "List endpoints."
+    risk: read
+    inputs_schema:
+      properties:
+        limit: { type: number, description: "Max endpoints (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_endpoint
+    name: sophos-get-endpoint
+    description: "Get a single endpoint by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        endpoint_id: { type: string, description: "Endpoint ID" }
+      required: [endpoint_id]
+    outputs_schema: { properties: {} }
+  - id: isolate_endpoint
+    name: sophos-isolate-endpoint
+    description: "Isolate an endpoint from the network (containment)."
+    inputs_schema:
+      properties:
+        endpoint_id: { type: string, description: "Endpoint ID" }
+        comment: { type: string, description: "Optional comment" }
+      required: [endpoint_id]
+    outputs_schema: { properties: {} }
+  - id: deisolate_endpoint
+    name: sophos-deisolate-endpoint
+    description: "Remove an endpoint from isolation."
+    inputs_schema:
+      properties:
+        endpoint_id: { type: string, description: "Endpoint ID" }
+        comment: { type: string, description: "Optional comment" }
+      required: [endpoint_id]
+    outputs_schema: { properties: {} }
+  - id: scan_endpoint
+    name: sophos-scan-endpoint
+    description: "Trigger a malware scan on an endpoint."
+    inputs_schema:
+      properties:
+        endpoint_id: { type: string, description: "Endpoint ID" }
+      required: [endpoint_id]
+    outputs_schema: { properties: {} }
+  - id: list_alerts
+    name: sophos-list-alerts
+    description: "List alerts."
+    risk: read
+    inputs_schema:
+      properties:
+        limit: { type: number, description: "Max alerts (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: sophos-test-connection
+    description: "Verify the credentials and tenant discovery (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }