> For the complete documentation index, see [llms.txt](https://docs.onum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onum.com/listeners/listener-integrations/pull-data-from-http-endpoints/pull-data-from-the-sophos-api.md).

# Pull data from the Sophos API

## Overview

Get a list of events through the [Sophos API](https://developer.sophos.com/docs/siem-v1/1/routes/events/get) using the **HTTP Pull** Listener.

## HTTP Pull Listener configuration

In Falcon Onum, go to the **Listeners** area and click **New Listener > HTTP Pull**. Give a name to your new Listener and enter the following data:

### Parameters

N/A

### Secrets

You must define these credentials in Onum:

* `sophosClientId` will reference your Salesforce client ID.
* `sophosClientSecret` will reference your Salesforce client secret.

To do it, click **Add element** and enter a **Name** for the secret (in this case, `sophosClientId`). Then, click the **Value** field and select **New secret** to create a new one:

* Give the secret a **Name**.
* Turn off the **Expiration date** option.
* Click **Add new value** and paste the secret corresponding to the value.
* Click **Save**.

You can now select the secret you just created in the **Value** field list. Repeat the process for `sophosClientSecret`.

{% hint style="info" %}
Learn more about secrets in Onum in [this article](/settings/organization-settings/secrets-management.md).
{% endhint %}

### Setup

After entering the required parameters and secrets, you can choose to manually enter the rest of configuration fields, or simply paste the given YAML:

{% tabs %}
{% tab title="Config as YAML" %}
Toggle **ON** the **Config as YAML** option to enable a free text field where you can paste the following YAML:

```yaml
withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: Epoch
withAuthentication: true
authentication:
  type: token
  token:
    request:
      method: POST
      url: https://id.sophos.com/api/v2/oauth2/token
      headers:
        - name: Accept
          value: application/json
        - name: Content-Type
          value: application/x-www-form-urlencoded
      queryParams: []
      bodyType: urlEncoded
      bodyParams:
        - name: grant_type
          value: client_credentials
        - name: client_id
          value: '${secrets.sophosClientId}'
        - name: client_secret
          value: '${secrets.sophosClientSecret}'
        - name: scope
          value: token
    tokenPath: ".access_token"
    authInjection:
      in: header
      name: Authorization
      prefix: 'Bearer '
      suffix: ''
withEnumerationPhase: true
enumerationPhase:
  paginationType: none
  request:
    responseType: json
    method: GET
    url: https://api.central.sophos.com/whoami/v1
    headers:
      - name: Accept
        value: application/json
      - name: Accept-Encoding
        value: gzip, deflate
      - name: Content-Type
        value: application/json
      - name: Cache-Control
        value: no-cache
    queryParams: []
    bodyParams: []
  output:
    select: "."
    filter: "."
    map: "."
    outputMode: element

collectionPhase:
  variables:
    - source: input
      name: tenantId
      expression: ".id"
      format: ''
    - source: input
      name: dataRegionURL
      expression: ".apiHosts.dataRegion"
      format: ''
  paginationType: cursor
  cursorSelector: ".next_cursor"
  initialRequest:
    method: GET
    url: "${inputs.dataRegionURL}/siem/v1/events"
    headers:
      - name: Accept
        value: application/json
      - name: Accept-Encoding
        value: gzip, deflate
      - name: X-Tenant-ID
        value: "${inputs.tenantId}"
    queryParams:
      - name: from_date
        value: "${temporalWindow.from}"
    bodyParams: []
  nextRequest:
    method: GET
    url: "${inputs.dataRegionURL}/siem/v1/events"
    headers:
      - name: Accept
        value: application/json
      - name: Accept-Encoding
        value: gzip, deflate
      - name: X-Tenant-ID
        value: "${inputs.tenantId}"
    queryParams:
      - name: cursor
        value: "${pagination.cursor}"
    bodyParams: []
  output:
    select: ".items"
    filter: "."
    map: "."
    outputMode: element
```

{% endtab %}

{% tab title="Manually configure" %}
**Temporal Window**

Toggle **ON** to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

* **Duration** - `5m`
* **Offset** - `5m`
* **Format** - `Epoch`

**Authentication**

Toggle **ON** to configure the authentication phase.

* **Type** - `token`
* **Token Retrieve Based Authentication**
  * **Request** 
    * **Method** - `POST`
    * **URL** - `https://id.sophos.com/api/v2/oauth2/token`
    * **Headers**
      * **Name** - `Accept`
      * **Value** - `application/json`
      * **Name** - `Content-Type`
      * **Value** - `application/x-www-form-urlencoded`
    * **Body Type** - `urlEncoded`
    * **Body Params**
      * **Name** - `grant_type`
      * **Value** - `client_credentials`
      * **Name** - `client_id`
      * **Value** - `${secrets.sophosClientId}`
      * **Name** - `client_secret`
      * **Value** - `${secrets.sophosClientSecret}`
      * **Name** - `scope`
      * **Value** - `token`
* **Token path** - `.access_token`
* **Auth injection**
  * **In** - `header`
  * **Name** - `Authorization`
  * **Prefix** - `'Bearer '`
  * **Suffix** - `''`

**Enumeration Phase**

Toggle **ON** and configure the following:

* **Pagination Type** - `None`
* **Request**
  * **Response Type** - `JSON`
  * **Method** - `GET`
  * **URL** - `https://api.central.sophos.com/whoami/v1`
  * **Headers**
    * **Name** - `Accept`
    * **Value** - `application/json`
    * **Name** - `Accept-Encoding`
    * **Value** - `gzip, deflate`
    * **Name** - `Content-Type`
    * **Value** - `application/json`
    * **Name** - `Cache-Control`
    * **Value** - `no-cache`
* **Output**
  * **Select** - `.`
  * **Filter** - `.`
  * **Map** - `.`
  * **Output Mode** - `element`

**Collection Phase**

* **Inputs** 
  * **Name** - `tenantId`
  * **Expression** - `.id`
  * **Name** - `dataRegionURL`
  * **Expression** - `.apiHosts.dataRegion`
* **Pagination Type** - `Cursor`
* **Cursor Selector** - `.next_cursor`
* **Initial Request** 
  * **Response Type** - `JSON`
  * **Method** - `GET`
  * **URL** - `${inputs.dataRegionURL}/siem/v1/events`
* **Headers**
  * **Name** - `Accept`
  * **Value** - `application/json`
  * **Name** - `Accept-Encoding`
  * **Value** - `gzip, deflate`
  * **Name** - `X-Tenant-ID`
  * **Value** - `${inputs.tenantId}`
* **Query Params**
  * **Name** - `from_date`
  * **Value** - `${temporalWindow.from}`
* **Next Request** 
  * **Response Type** - `JSON`
  * **Method** - `GET`
  * **URL** - `${inputs.dataRegionURL}/siem/v1/events`
* **Headers**
  * **Name** - `Accept`
  * **Value** - `application/json`
  * **Name** - `Accept-Encoding`
  * **Value** - `gzip, deflate`
  * **Name** - `X-Tenant-ID`
  * **Value** - `${inputs.tenantId}`
* **Query Params**
  * **Name** - `cursor`
  * **Value** - `${pagination.cursor}`
* **Output** 
  * **Select** - `.items`
  * **Filter** - `.`
  * **Map** - `.`
  * **Output Mode** - `element`
    {% endtab %}
    {% endtabs %}

When you're done, click **Create labels** to move on to the next step and define the required [Labels](https://app.gitbook.com/o/9sm794iTBacZSmhxRER6/s/kxZeV4nlXcIAjMGZxzLI/the-workspace/listeners/labels) if needed.