How to know from logs that the detected virus had been cleaned successfully

Hi John,

Thanks for reaching out to the Sophos Community Forum. 

Do you know if this response is returned when running the "Get events" or "Get alerts" API query? 

I'd like to run a similar query with a detection and cleanup event on my environment to compare the results.

Thanks Kushal, as far as I know, the log are retrieved by created a database view that queries from dbo.Threats table.

Thanks for following up with us. 

Let me know if the dbo.Threats table is located within your SIEM system or if this is based off of a Sophos Enterprise Console environment, as the SEC database also references the same table name. 

To give you some more context, you can see further information on the values that will be returned when sending each HTTP request respectively in the links below. 
- /alerts (GET)
- events (GET)

The information from your SIEM system appears to have a few more fields.

Thanks for following up with us. 

Let me know if the dbo.Threats table is located within your SIEM system or if this is based off of a Sophos Enterprise Console environment, as the SEC database also references the same table name. 

To give you some more context, you can see further information on the values that will be returned when sending each HTTP request respectively in the links below. 
- /alerts (GET)
- events (GET)

The information from your SIEM system appears to have a few more fields.