id: sophos_central
name: Sophos Central
version: 1.0.0
description: "Sophos Central (Endpoint API) — endpoint containment: list and read endpoints, isolate/de-isolate a host, trigger a scan, and list alerts. OAuth2 client-credentials authentication (with tenant discovery); stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get endpoints, isolate/de-isolate, scan, list alerts."
category: endpoint

# Per-instance configuration. Client credentials are exchanged for a token; the
# whoami endpoint provides the tenant ID and regional API host used thereafter.
config_schema:
  properties:
    client_id:
      type: string
      description: "Sophos Central API client ID"
    client_secret:
      type: string
      description: "Sophos Central API client secret"
      x-soar-sensitive: true
  required:
    - client_id
    - client_secret

commands:
  - id: list_endpoints
    name: sophos-list-endpoints
    description: "List endpoints."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max endpoints (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_endpoint
    name: sophos-get-endpoint
    description: "Get a single endpoint by ID."
    risk: read
    inputs_schema:
      properties:
        endpoint_id: { type: string, description: "Endpoint ID" }
      required: [endpoint_id]
    outputs_schema: { properties: {} }
  - id: isolate_endpoint
    name: sophos-isolate-endpoint
    description: "Isolate an endpoint from the network (containment)."
    inputs_schema:
      properties:
        endpoint_id: { type: string, description: "Endpoint ID" }
        comment: { type: string, description: "Optional comment" }
      required: [endpoint_id]
    outputs_schema: { properties: {} }
  - id: deisolate_endpoint
    name: sophos-deisolate-endpoint
    description: "Remove an endpoint from isolation."
    inputs_schema:
      properties:
        endpoint_id: { type: string, description: "Endpoint ID" }
        comment: { type: string, description: "Optional comment" }
      required: [endpoint_id]
    outputs_schema: { properties: {} }
  - id: scan_endpoint
    name: sophos-scan-endpoint
    description: "Trigger a malware scan on an endpoint."
    inputs_schema:
      properties:
        endpoint_id: { type: string, description: "Endpoint ID" }
      required: [endpoint_id]
    outputs_schema: { properties: {} }
  - id: list_alerts
    name: sophos-list-alerts
    description: "List alerts. Used for ingestion: results path = items."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max alerts (default 50)" }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: items
      dedup_key: id

  - id: test_connection
    name: sophos-test-connection
    description: "Verify the credentials and tenant discovery (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

ingestion:
  command: list_alerts
  mapper: list_alerts
  default_incident_type: "Sophos Central Alert"