How query 35 Sub-Estates from Sophos Central Intercept X Advanced

Hello, volpedan,

We appreciate your reaching out to the Sophos Community Forum.

So yes, to use live query, you must have the sophos XDR license. 

Please refer to this article for more information: https://www.sophos.com/en-us/products/endpoint-antivirus/tech-specs.

Regards, 

For SQL-based queries, Rutvik is correct. However, if you're looking to automate things like endpoint policy or user management, you can use some of the APIs, such as Endpoint, Account Healthcheck, and Account Management with your current license. See https://developer.sophos.com/ for more information. There are also some sample scripts that use the APIs on GitHub. See, for example, https://github.com/sophos/sophos-central-api-connector and https://github.com/sophos/PS.Machine_Health.  

For SQL-based queries, Rutvik is correct. However, if you're looking to automate things like endpoint policy or user management, you can use some of the APIs, such as Endpoint, Account Healthcheck, and Account Management with your current license. See https://developer.sophos.com/ for more information. There are also some sample scripts that use the APIs on GitHub. See, for example, https://github.com/sophos/sophos-central-api-connector and https://github.com/sophos/PS.Machine_Health.