Sophos Central

• New alertRuns when Sophos Central raises an alert, such as malware or a PUA found, a device not protected or an update failing, with the device, person and what can be done about it. Alerts raised before the workflow was turned on don't start it. How often it checks follows your workspace plan.
• New eventRuns for each new entry of the kind you choose in Sophos Central's event log, such as malware detected or cleaned up, an endpoint isolated or an update failing. Events before the workflow was turned on don't start it. How often it checks follows your workspace plan.
• New endpointRuns when a computer or server registers with Sophos Central, with its hostname, operating system, addresses, group and person. Endpoints registered before the workflow was turned on don't start it. How often it checks follows your workspace plan.
• Endpoint health turned badRuns when an endpoint's health turns bad (or suspicious, if you choose), such as from an active threat or a stopped Sophos service, with the endpoint. Once it is healthy again, it runs again the next time. Endpoints already unhealthy when the workflow is turned on don't start it. How often it checks follows your workspace plan.
• Endpoint isolatedRuns when an endpoint is cut off from the network, by a person, a workflow or the endpoint itself, with the endpoint. Once it is released, it runs again the next time. Endpoints isolated when the workflow is turned on don't start it. How often it checks follows your workspace plan.
• Endpoint went offlineRuns when an endpoint stops talking to Sophos Central, with when it was last seen. Once it is back online, it runs again the next time. Endpoints offline when the workflow is turned on, or for more than a week, don't start it. How often it checks follows your workspace plan.
• Tamper Protection turned offRuns when Tamper Protection is turned off on an endpoint that supports it, with the endpoint. Once it is back on, it runs again the next time. Endpoints with it off when the workflow is turned on don't start it. How often it checks follows your workspace plan.

• List alertsFind Sophos Central alerts, newest first, by severity, category, product or time, with the device and person each is about and what can be done about it.
• Get alertGet one alert: what happened, its severity and category, the device and person, and the actions it allows.
• Act on alertAcknowledge an alert, clean up or clear its threat, clean up or authorize a PUA, or message the user. Only the actions in the alert's allowed_actions work.
• List endpointsFind computers and servers protected by Sophos, by health, type, isolation, online state, Tamper Protection, group, hostname, person, IP address or when last seen.
• Get endpointGet one endpoint: its health, operating system, addresses, group, person, isolation, Tamper Protection and installed Sophos products.
• Isolate endpointsCut endpoints off the network so a threat can't spread. They can still reach Sophos Central, so they can be cleaned up and released.
• Release endpoints from isolationPut isolated endpoints back on the network.
• Get endpoint isolationWhether an endpoint is set to be isolated, with who last isolated or released it, when and why.
• Scan endpointsStart a scan on each endpoint. Any threat it finds is raised as an alert.
• Check endpoint for updatesAsk an endpoint to check for Sophos updates now rather than at its next scheduled check.
• Get Tamper ProtectionWhether Tamper Protection is on for an endpoint, with its current password (to change Sophos settings or uninstall on the endpoint) and old passwords.
• Update Tamper ProtectionTurn Tamper Protection on or off for an endpoint, make a new password for it, or both.
• List endpoint groupsList the groups endpoints are organised in, by name, with how many endpoints each holds.
• Create endpoint groupMake a group of computers or servers, with endpoints in it if you choose them.
• Add endpoints to groupMove endpoints into a group, taking them out of any group they were in.
• Remove endpoints from groupTake endpoints out of a group. They stay protected, in no group.
• Delete endpoint groupDelete an endpoint group. Its endpoints stay protected, in no group.
• List blocked itemsList the files blocked from running on every endpoint, with why and who blocked each.
• Block fileBlock a file from running on every endpoint, by its SHA-256 hash, such as one from an alert or event.
• Unblock fileRemove a blocked item, so the file may run again.
• List usersList the people in Sophos Central's directory, by name, with their email and groups.
• Get userGet one person from the directory, such as the person on an endpoint or in an alert.
• List eventsRead Sophos Central's event log from the last 24 hours, oldest first: threats found and cleaned, endpoints registered, updates failing, web sites blocked and more.
• Get account health checkGet Sophos Central's account health check: scores from 0 to 100 for protection installed, policies, risky exclusions and Tamper Protection, and how many endpoints fall short.

No actions match that.