This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Install status report

We've recently rolled out Intercept X via the SC panel.

I'm simply looking for a report on each user or computers install status, to include their current endpoint protection and also show if the Intercept X product is installed. At this current time we are in the dark as to who is currently protected by IX.

Looking at the reports dashboard there isn't really anything that meets this, the closest I can get is seeing if a computer or user is generally protected, but with no detailed breakdown.

Is there any way to build custom reports (something I'm surprised doesn't already exist)?

Thanks in advance.

This thread was automatically locked due to age.

0 jak over 8 years ago

One quick way to create a report for 50 computers might be to:
1. Open the Dev tools of the browser, e.g. F12

2. On the Network tab

3. Visit the page
https://cloud.sophos.com/manage/devices/computers/all/computers

4. You will see the request to get the data from the APIs, e.g.:
https://dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com/api/user-devices?endpoint_type=computer&get_health_status=true&limit=50&offset=0

5. If you copy out the JSON data response, you can paste it into a site such as https://konklone.io/json/ to create a CSV of the data.

Hopefully the reports will be more customisable in the future. There is the API - https://community.sophos.com/kb/en-us/125398 which might also be worth a look.

Regards,

Jak

If you need more than 50 records, I think the above API will allow you to adjust the limit to be a little higher, maybe 100. I'd probably use a browser extension such as DHC Restlet Client. You might need to just add the X-Hammer-Token header and the value from the previous request and then set the same URI. You could certainly change the offset to a allowed batch size and make multiple requests.
Cancel
Vote Up 0 Vote Down

Cancel
0 dbmnl over 8 years ago in reply to jak

Hi Jak,

Thanks for the reply.

I'm getting access denied when following these API links loaded by the page, do I need to authenticate with the API too?
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 8 years ago in reply to dbmnl

You would need to login to your Central account first. You may even be using a different region so the URL would be different but you are looking for this API call:

...api/user-devices?endpoint_type=computer&get_health_status=true&limit=50&offset=0

Here is the example:
Cancel
Vote Up 0 Vote Down

Cancel