Malware/PUA alerts not listed in 'alerts' API?

Question

In our tenant we have one machine which has consistently reported malware/PUA (due to a fortunate false positive) which makes for a good test case. The endpoint API lists its overall and threats health status as 'suspicious' but there's no expanded health info for threats. The alerts API lists several failures to protect, which I also need to know about, but no malware/PUA. 
 Am I looking in the wrong place or is this just not yet reported?

rcbolio · Answer

Hi John Brodhurst , 
 I believe the situation here is that the malware/PUA detections are events and not alerts, so they will not be retrievable via the Alert API. A malware/PUA detection will only become an alert if there is an action pending for the admin to do, such as a manual clean up required. If Sophos made a detection and cleaned up the malware/PUA subsequently, an alert won't be raised. If these are events, then you can use the SIEM API to retrieve those events: https://support.sophos.com/support/s/article/KB-000036372?language=en_US 
 Thanks 
 Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts If a post solves your question use the 'Verify Answer' link.

Malware/PUA alerts not listed in 'alerts' API?

Top Replies