Sophos Central - Retrieving Alerts via API

Question

Hi, 
 We're trying to retrieve all Sophos Central alerts going back 12 months using the Sophos API but we're only able to see alerts from the previous 24 hours. Are we able to do this? 
 
 Thanks in advance

Kyle Parrish · Accepted Answer

Hi! 
 Unfortunately, it looks like Sophos Central only stored event data for the past 90 days. That will be as far back as you can go. 
 GitHub - sophos-cybersecurity/sophos-central-api-connector: Gather alerts and endpoint data from your Sophos Central tenants

FormerMember · Answer

Yes, Central's data retention is 90 days for GDPR.

Sophos Central - Retrieving Alerts via API

Top Replies