Security
Sophos Central
EDR & endpoint protection — alerts, endpoint health, threat quarantine, and isolation.
Command it in chat
Ask the Orbit Assistant about your Sophos Central data in plain English — it plans the API calls and answers clearly, not with raw JSON.
Automate it with skills
Put Sophos Central inside autonomous skills and playbooks that run on schedules, webhooks, or events — and chain it with your other tools.
Governed by default
Set action policies and member access, require approvals where needed, and review recorded activity. Supported autonomy modes depend on your plan.
15 built-in actions
Explore fictional results in workspace Simulated mode before connecting credentials. Real actions follow workspace approval policies; validate the actions you need with your own account.
List Alerts
list_alerts
List Endpoints
list_endpoints
Get Endpoint
get_endpoint
Isolate Endpoint
isolate_endpoint
Remove Isolation
remove_isolation
Trigger Endpoint Scan
scan_endpoint
Get Endpoint Threats
get_endpoint_threats
List Quarantine Items
list_quarantine_items
Authorize Quarantine Item
authorize_quarantine_item
Delete Quarantine Item
delete_quarantine_item
Get Tamper Protection Status
get_tamper_protection
Toggle Tamper Protection
toggle_tamper_protection
List Allowed Items
list_allowed_items
Add Allowed Item
add_allowed_item
List Security Events
list_events
Explore before you connect
Explore Sophos Central in a workspace with fictional sample data before adding credentials. Workspace simulations may use AI Power; signup may require a beta invite.
Explore in a workspace