Guest User!
You are not Sophos Staff.
Dear Sir/Madam,
i was wondering if there is a report that can be ran in the sophos console to find out when the tamper protection was disabled and who by.
If someone could point me in the right direction i would be very grateful.
Thanks
Darren
From looking at the API responses that feed the list views and reports in the UI of Central, it doesn't seem that the information is available in one go. It would be possible but it's not as trivial as it appears at first glance.
The JSON looks like it contains the information required from the API response from:
https://dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com/api/user-devices?endpoint_type=computer&get_health_status=true&limit=50&offset=0 
But sadly the values aren't populated from this API query.
The only API that returns the information is the one that feeds the individual device page, i.e.
It would be quite easy to query the APIs from a scripting language such as Powershell but to get the TP info you'd need to get a list of machine ids from one API and then make a query to another for each device to get the tamper details. Not impossible but could be a lot of queries if you have a lot of devices.
Regards,
Jak
