Actions27
- Alert Actions
- Diagnostic Actions
- Firewall Actions
- Firewall Group Actions
- Firmware Actions
- Health Actions
- Licensing Actions
- Organization Actions
- Partner Actions
Alert → Get Many
AI-generatedSummary
Retrieve alerts for a Sophos Central tenant, optionally fetching every page and filtering the results. Each returned alert is enriched with actionability fields for use in downstream workflow steps.
Inputs
- Tenant (required) — Select a tenant from the list or provide its ID. Organization credentials can supply the tenant from the credential; Partner credentials require a tenant selection.
- Return All — Defaults to false. When enabled, fetches all alert pages; otherwise, returns up to the Limit.
- Limit — Maximum alerts to fetch when Return All is off; defaults to 50 (allowed range 1–1000).
- Filters — Optional filters: Only Actionable keeps alerts with at least one allowed action; Severity accepts Low, Medium, and/or High; Product selects a product type (defaults to Firewall); Start Date passes a creation-date lower bound.
Output shape
A list of alert items, one per returned alert.
Each item contains the alert fields returned by Sophos, plus isActionable, actionCount, and hasBeenActioned. Severity, Product, and Start Date are sent as API query filters; Only Actionable is applied to the fetched results. With Return All off, the limit applies before the Only Actionable filter, so fewer items than the limit may be returned.