Sophos Central MCP Server

Get account health check report for a tenant. Shows protection coverage, policy compliance, and configuration issues across endpoints and network devices.

Get account health score comparisons against regional peers. Useful for benchmarking your tenant's security posture against similar tenants in your region.

Get historical account health check scores for a tenant to track improvement over time.

Snooze specific health check findings for endpoint or network device categories. The snooze body mirrors the health-check response structure — specify the categories/sub-categories you want to snooze.

List alerts from Sophos Central for a given tenant, with optional severity, product, category, date range, and pagination filters.

Search alerts using a POST request body. Equivalent to sophos_list_alerts but filters are sent in a JSON body — useful for filtering by multiple IDs or long lists of categories/products.

Get the full details of a specific alert by ID, including its allowedActions list.

Perform an action on a specific alert. Valid actions depend on the alert type and are listed in the alert's allowedActions field. Common actions include: 'acknowledge', 'cleanPua', 'authPua', 'clearThreat', 'clearHmpa', 'sendMsgPua', 'sendMsgThreat'.

Acknowledge a specific alert. Convenience shortcut — equivalent to sophos_take_alert_action with action='acknowledge'.

List all globally allowed items (SHA256 hashes, certificate signers, file paths) for a tenant.

Get details for a specific globally allowed item.

Add a globally allowed item. For 'sha256' type supply sha256. For 'path' type supply fileName and optionally path. For 'certificateSigner' type supply certificateSigner.

Update the comment/reason on an existing globally allowed item.

Delete a globally allowed item.

List all globally blocked items (SHA256 hashes) for a tenant.

Get details for a specific globally blocked item.

Block an item by SHA256 hash globally. Optionally include filename and path for context.

Remove a globally blocked item (unblock it).

List globally blocked IP addresses and ranges for a tenant.

Block multiple IP addresses or ranges in a single call. Accepts IPv4/IPv6 addresses, CIDR notation (e.g. 1.2.3.0/24), and dash-separated ranges (e.g. 1.2.3.4-1.2.3.10).

Remove multiple blocked IP address entries by their IDs in a single call.

List audit trail events for a Sophos Central tenant. Covers admin actions, policy changes, user logins, and configuration modifications. Supports filtering by date range, category, user, and cursor-based pagination.

Get the full details of a specific audit event by its ID, including the actor, action performed, affected resource, and timestamp.

List distributor quotes from the Sophos Business Automation API. Only approved quotes are returned. Requires a Distributor ID.

Get full details for a specific Sophos Business Automation quote by proposal number.

Return partner level information for a distributor's partners. Filters by billing sub-region and optionally by name, update date, or EDI number.

List all cases/investigations for a tenant with rich filtering options.

Get full details for a specific case/investigation by ID.

Create a new investigation case.

Update an existing case (name, type, severity, status, assignee, overview).

Delete an investigation case by ID.

Get impacted entities (endpoints, users, etc.) associated with a case.

Get the MITRE ATT&CK framework summary for a case — tactics and techniques observed across all associated detections.

List all detections associated with a case.

Get a specific detection within a case by detection ID.

Rename a cloud security runtime detection profile.

Start an async detections query run. Returns a run ID. Poll sophos_get_detections_query_status until status is 'finished', then retrieve results with sophos_get_detections_query_results.

Get the status of a running detections query. Poll until status is 'finished'. Result will be 'succeeded' or 'failed'.

Get results of a completed detections query. Only call after sophos_get_detections_query_status returns status='finished'.

Get detection counts grouped by severity and type over a time range. Returns per-hour or per-day buckets.

Start an async detection-groups query run. Groups detections by detection rule and device for a summary view. Returns a run ID to poll.

Get the status of a running detection-groups query. Poll until status is 'finished'.

Get results of a completed detection-groups query. Each item represents a group of similar detections with a count, detection rule, MITRE ATT&CK tags, and device info.

List directory users in a Sophos Central tenant.

Get details for a specific directory user.

Create a new directory user in a tenant.

Update a directory user's details.

Delete a directory user.

Add a user to one or more directory user groups.

Remove a user from one or more directory user groups.

List user groups in a tenant's directory.

Get details for a specific user group.

Create a new directory user group.

Update a directory user group's name or description.

Delete a directory user group.

List all users that are members of a specific directory user group.

Add one or more users to a directory user group.

Remove one or more users from a directory user group.

List all DNS Protection locations for a tenant.

Get details for a specific DNS Protection location.

Create a new DNS Protection location. Provide either IP addresses or domain names (combined total max 100).

Update a DNS Protection location. Send an empty array for ip_addresses or domain_names to clear them.

Delete a DNS Protection location.

List all DNS Protection policies for a tenant.

Get details for a specific DNS Protection policy.

Create a new DNS Protection policy with category filtering, allowed/blocked custom domain lists, and safe-search settings.

Update a DNS Protection policy. For array fields (locationIds, allowedCustomDomainIds, etc.) send a full replacement array, null to clear, or an add/remove object.

Delete a DNS Protection policy.

List custom domain lists (allowed/blocked) for DNS Protection.

Get a specific custom domain list.

Create a custom domain list for DNS Protection. The list is assigned as allowed or blocked on a policy (via sophos_dns_create_policy or sophos_dns_update_policy), not typed here.

Update a custom domain list (name, description, or domains).

Delete a custom domain list.

Search pre-delivery quarantine messages with structured filters. This is the primary way to list quarantined messages.

Get details for a specific pre-delivery quarantined message by ID.

Preview the content (headers, body snippet) of a pre-delivery quarantined message.

Get URLs found in a pre-delivery quarantined message.

List attachments of a pre-delivery quarantined message.

Release one or more pre-delivery quarantined messages to recipients. Optionally allow sender or submit to labs.

Delete one or more pre-delivery quarantined messages. Optionally block sender.

Strip specific attachments from a pre-delivery quarantined message and release it to specified recipients.

Reattach previously stripped attachments to a quarantined message.

Initiate a download job for attachments from a pre-delivery quarantined message. Returns a downloadId for status polling.

Get the status of a quarantine attachment download job initiated by sophos_download_quarantine_attachments.

Search post-delivery quarantine messages (messages that were delivered but later quarantined). Use this for clawback/post-delivery remediation workflows.

Preview the content of a post-delivery quarantined message.

List attachments of a post-delivery quarantined message.

Release one or more post-delivery quarantined messages back to recipients.

Delete one or more post-delivery quarantined messages.