Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-supported-automations

Supported playbooks, actions, and connectors

Sophos XDR supports the following playbooks, response actions, and connectors.

Playbooks define what actions run and when they run. Playbooks use one or more configured connections to perform actions automatically or on demand. For more information, see Playbooks overview.

Playbook Description Supported vendors and products
Case Event Creates an event or incident from a case.
  • EverBridge EverBridge Suite
  • PagerDuty On-Call Management
Case Sync Synchronizes cases with supported third-party platforms.
  • Atlassian Jira
  • CrowdStrike Falcon
  • Freshworks Freshdesk
  • Freshworks Freshservice
  • Halo ITSM
  • ManageEngine ServiceDesk Plus
  • Microfocus SMAX
  • PagerDuty On-Call Management
  • Palo Alto Networks Cortex XSOAR
  • Zendesk Suite
Case Translate Comments Translates case comments into another language.
  • Sophos Fusion
Case Translate Key Findings Translates case key findings into another language.
  • Sophos Fusion
Enrich Case Adds enrichment results to a case's key findings.
  • JupiterOne API
  • Microsoft Azure OpenAI
  • OpenAI API
  • SCADAfence Platform
Health Event Case Creates cases from health events.
  • Sophos Fusion
Isolate Host Automated Action Automatically isolates or unisolates supported hosts.
  • CrowdStrike Falcon Endpoint Protection
  • HarfangLab Endpoint Detection and Response
  • Microsoft Defender ATP
  • SentinelOne
  • Sophos Endpoint
  • Taegis Endpoint
  • VMWare Carbon Black Cloud
Send Email Sends an email through a supported email platform.
  • Google Gmail API
Send Notification Message Sends a notification through a supported messaging platform.
  • Google Workspace Chat Webhook
  • Microsoft Teams
  • Salesforce Slack
Send to Webhook Sends playbook inputs to a webhook URL.
  • Generic webhook
Sync Alert Synchronizes a third-party alert with a detection.
  • Microsoft Graph API
User Automated Response Actions Runs automated response actions for users.
  • Amazon Web Services Identity and Access Management
  • Cisco Duo Admin API
  • Google Workspace Admin SDK
  • Microsoft Active Directory/LDAP
  • Microsoft Graph API
  • Okta API
xMatters Webhook Case Triggers an xMatters event from a case using a webhook.
  • xMatters Webhook

Actions are predefined response and enrichment operations that you can run from supported areas of Sophos XDR. For more information, see Actions.

Action Description Supported vendors and products
Analyze Email Enriches an email with additional information.
  • Microsoft Graph API
Block Domain Blocks access to a specified domain.
  • Check Point Quantum
  • Cisco Meraki
  • Fortinet FortiGate
  • Microsoft Defender ATP
  • Mimecast Email Security Cloud Gateway
  • Palo Alto Networks PAN-OS
  • SonicWall SonicOS
  • Sophos Firewall
Block Email Address Blocks a specified email address.
  • Mimecast Email Security Cloud Gateway
Block File Hash Blocks files matching a specified file hash.
  • CrowdStrike Falcon Endpoint Protection
  • Microsoft Defender ATP
  • SentinelOne XDR
  • Sophos Endpoint
  • VMWare Carbon Black EDR
Block IP Blocks a specified IP address.
  • Amazon Web Services WAFV2
  • Check Point Quantum
  • Cisco Meraki
  • Cloudflare API
  • Fortinet FortiGate
  • Microsoft Defender ATP
  • Palo Alto Networks PAN-OS
  • SonicWall SonicOS
  • Sophos Firewall
  • Sophos NDR
Block URL Blocks access to a specified URL.
  • Check Point Quantum
  • Cisco Meraki
  • Fortinet FortiGate
  • Microsoft Defender ATP
  • Sophos Firewall
  • Zscaler ZIA
Change Password Changes a user's password.
  • Amazon Web Services Identity and Access Management
  • Google Workspace Admin SDK
  • Microsoft Active Directory/LDAP
  • Microsoft Graph API
  • Okta API
Change Password At Next Login Requires a user to change their password at next login.
  • Amazon Web Services Identity and Access Management
  • Google Workspace Admin SDK
  • Microsoft Active Directory/LDAP
  • Microsoft Graph API
  • Okta API
Clawback Retracts an email from recipients.
  • Sophos Email
Collect Forensic Logs Collects forensic logs from a host.
  • Sophos Endpoint
Collect Memory Dump Collects a memory dump from a host.
  • Sophos Endpoint
Confirm User As Compromised Marks a user as compromised.
  • Microsoft Graph API
Deactivate Change Password At Next Login Removes the requirement to change password at next login.
  • Google Workspace Admin SDK
  • Microsoft Active Directory/LDAP
Detonate URL Analyzes a URL and returns enrichment results.
  • VMRay API
Disable Adaptive Attack Protection Disables Adaptive Attack Protection on a host.
  • Sophos Endpoint
Disable Inbox Rule Disables a user's inbox rule.
  • Microsoft Graph API
Disable User Disables a user account.
  • Amazon Web Services Identity and Access Management
  • Cisco Duo Admin API
  • Google Workspace Admin SDK
  • Microsoft Active Directory/LDAP
  • Microsoft Graph API
  • Okta API
Dismiss User As Compromised Marks a user as not compromised.
  • Microsoft Graph API
Enable Adaptive Attack Protection Enables Adaptive Attack Protection on a host.
  • Sophos Endpoint
Enable Inbox Rule Enables a user's inbox rule.
  • Microsoft Graph API
Enable User Enables a user account.
  • Amazon Web Services Identity and Access Management
  • Cisco Duo Admin API
  • Google Workspace Admin SDK
  • Microsoft Active Directory/LDAP
  • Microsoft Graph API
  • Okta API
Entity Enrichment Look Up Asset Retrieves information about an asset.
  • Claroty xDome
Extend Adaptive Attack Protection Extends Adaptive Attack Protection on a host.
  • Sophos Endpoint
Initiate Antivirus Scan on Host Starts an antivirus scan on a host.
  • HarfangLab Endpoint Detection and Response
  • Microsoft Defender ATP
  • SentinelOne XDR
  • Sophos Endpoint
Isolate Host Isolates a host from the network.
  • CrowdStrike Falcon Endpoint Protection
  • HarfangLab Endpoint Detection and Response
  • Microsoft Defender ATP
  • SentinelOne XDR
  • Sophos Endpoint
  • Taegis Endpoint
  • VMWare Carbon Black Cloud
Look Up File Hash Retrieves enrichment information for a file hash.
  • VMRay API
Look Up User Retrieves information about a user.
  • Amazon Web Services Identity and Access Management
  • Cisco Duo Admin API
  • Google Workspace Admin SDK
  • Microsoft Active Directory/LDAP
  • Microsoft Graph API
  • Okta API
Reset MFA Factors Resets a user's MFA factors.
  • Okta API
Revoke User Sign-In Sessions Revokes a user's active sign-in sessions.
  • Google Workspace Admin SDK
  • Microsoft Graph API
  • Okta API
UnBlock Domain Removes a block on a specified domain.
  • Check Point Quantum
  • Cisco Meraki
  • Fortinet FortiGate
  • Microsoft Defender ATP
  • Mimecast Email Security Cloud Gateway
  • Palo Alto Networks PAN-OS
  • SonicWall SonicOS
  • Sophos Firewall
UnBlock Email Address Removes a block on a specified email address.
  • Mimecast Email Security Cloud Gateway
UnBlock File Hash Removes a block on a specified file hash.
  • CrowdStrike Falcon Endpoint Protection
  • Microsoft Defender ATP
  • SentinelOne XDR
  • Sophos Endpoint
  • VMWare Carbon Black EDR
UnBlock IP Removes a block on a specified IP address.
  • Amazon Web Services WAFV2
  • Check Point Quantum
  • Cisco Meraki
  • Cloudflare API
  • Fortinet FortiGate
  • Microsoft Defender ATP
  • Palo Alto Networks PAN-OS
  • SonicWall SonicOS
  • Sophos Firewall
  • Sophos NDR
UnBlock URL Removes a block on a specified URL.
  • Check Point Quantum
  • Cisco Meraki
  • Fortinet FortiGate
  • Microsoft Defender ATP
  • Sophos Firewall
  • Zscaler ZIA
UnIsolate Host Restores network access for an isolated host.
  • CrowdStrike Falcon Endpoint Protection
  • HarfangLab Endpoint Detection and Response
  • Microsoft Defender ATP
  • SentinelOne XDR
  • Sophos Endpoint
  • Taegis Endpoint
  • VMWare Carbon Black Cloud

Connectors define how Sophos XDR communicates with an external IT tool. Playbooks use connectors to interact with vendor APIs. For more information, see Connectors overview.

Connector Description
4me ITSM Integrates with 4me ITSM.
Amazon Web Services WAFV2 Integrates with Amazon Web Services WAFV2.
Amazon Web Services Identity and Access Management Performs actions on AWS Identity and Access Management users.
Atlassian Jira Integrates with Jira Cloud and Jira Server.
Atlassian Opsgenie Sends cases and high- and critical-severity detections to Opsgenie alerts or incidents.
Cisco Duo Admin API Integrates with the Cisco Duo Admin API.
Cisco Meraki Integrates with Cisco Meraki.
Claroty xDome Integrates with Claroty xDome.
Cloudflare API Integrates with the Cloudflare API.
CrowdStrike Falcon Endpoint Protection Integrates with CrowdStrike Falcon Endpoint Protection.
EverBridge EverBridge Suite Integrates with EverBridge Suite.
Fortinet FortiGate Performs response actions using Fortinet FortiGate firewalls.
Freshworks Freshdesk Creates and queries tickets in Freshdesk.
Freshworks Freshservice Creates and queries tickets in Freshservice.
Generic Fetch Fetches a document.
Generic Webhook Provides a generic webhook integration.
GitLab API Fetches files from GitLab.
GitHub API Fetches files from GitHub.
Google Workspace Admin SDK Integrates with the Google Workspace Admin SDK API.
Google Workspace Chat Webhook Integrates with Google Workspace Chat webhooks.
Google Gmail API Integrates with the Gmail API.
Halo ITSM Creates, updates, and queries tickets in Halo ITSM.
HarfangLab Endpoint Detection and Response Integrates with HarfangLab Endpoint Detection and Response.
JupiterOne API Provides enrichment using the JupiterOne API.
ManageEngine ServiceDesk Plus Creates, updates, searches, and deletes ServiceDesk Plus requests.
Mattermost Integrates with Mattermost.
Microfocus SMAX Integrates with Microfocus SMAX.
Microsoft Azure OpenAI Integrates with Microsoft Azure OpenAI.
Microsoft Defender ATP Integrates with Microsoft Defender ATP.
Microsoft Graph API Performs response actions and investigative lookups using Microsoft Graph.
Microsoft Active Directory/LDAP Connects to Active Directory, AWS Directory Service, and LDAP using LDAP(S).
Microsoft Teams Sends messages to Microsoft Teams.
Mimecast Email Security Cloud Gateway Integrates with Mimecast Email Security Cloud Gateway.
Okta API Integrates with Okta.
OpenAI API Integrates with the OpenAI API.
PagerDuty On-Call Management Integrates with PagerDuty.
Palo Alto Networks Cortex XSOAR Integrates with Palo Alto Networks Cortex XSOAR.
Palo Alto Networks PAN-OS Integrates with standalone PAN-OS and Panorama firewalls.
SCADAfence Platform Integrates with the SCADAfence Platform.
Salesforce REST API Integrates with the Salesforce REST API.
Salesforce Slack Integrates with Slack.
SentinelOne XDR Integrates with SentinelOne.
ServiceNow ITSM Users Integrates with ServiceNow users.
ServiceNow ITSM Integrates with ServiceNow.
SonicWall SonicOS Integrates with SonicWall SonicOS firewalls.
Sophos Endpoint Integrates with the Sophos Endpoint API.
Sophos Live Discover Integrates with the Sophos Live Discover API.
Sophos Email Integrates with the Sophos Email Management API.
Sophos Firewall Integrates with the Sophos Firewall API.
Sophos Detection Works with Sophos detections.
Sophos Asset Works with Sophos assets.
Sophos Case Works with Sophos cases.
Sophos Cloud API Integrations Works with Sophos Cloud API integrations.
Sophos Comments Works with Sophos comments.
Sophos Datasource Works with Sophos data sources.
Sophos Entity Works with Sophos entities.
Sophos Event Works with Sophos events.
Sophos Findings Works with Sophos findings.
Sophos Case Works with Sophos case investigations.
Sophos NDR Integrates with Secureworks iSensor and NDR.
Sophos Notification Works with Sophos notifications.
Sophos Playbook Execution Retrieves playbook executions.
Sophos Preferences Works with Sophos preferences.
Sophos Process Tree Queries process trees for parent and child processes.
Sophos Query Language Looks up, creates, updates, saves, and deletes QL queries.
Sophos Rules Works with Sophos rules.
Sophos ShareLink Creates Sophos ShareLinks that point to supported entities.
Sophos Tenant Works with a Sophos tenant.
Sophos Threat Context Works with Sophos Threat Context.
Sophos User Works with Sophos users in the current tenant.
Taegis Endpoint Integrates with the Taegis Agent.
Twilio API Integrates with the Twilio API.
VMRay API Integrates with VMRay.
VMWare Carbon Black Cloud Integrates with VMWare Carbon Black Cloud.
VMWare Carbon Black EDR Integrates with VMWare Carbon Black EDR.
Zendesk Suite Creates and queries tickets in Zendesk Suite.
Zscaler ZIA Integrates with the Zscaler ZIA API.