{
   "flow": [
      {
         "flowID": "fda2867a-4179-4380-a111-ac69878afda3",
         "next": [
            {
               "flowID": "cd658f1d-2181-46bf-a0b1-cbb9c2a33baa",
               "logic": true,
               "order": 0,
               "tag": ""
            }
         ],
         "triggerID": "66f2d19ffb47d262a01433d3",
         "type": "trigger",
         "ui": {
            "x": -1500,
            "y": -325
         }
      },
      {
         "actionID": "66f2d19ffb47d262a01433d4",
         "flowID": "dcc4759a-f2a4-425b-8009-4f3efbfde318",
         "next": [
            {
               "flowID": "a7e2e4c5-c1e8-42cb-9d0b-3524c99fbac8",
               "logic": true,
               "order": 0,
               "tag": ""
            }
         ],
         "type": "action",
         "ui": {
            "x": -850,
            "y": -250
         }
      },
      {
         "actionID": "66f2d1a0fb47d262a01433d8",
         "flowID": "cd658f1d-2181-46bf-a0b1-cbb9c2a33baa",
         "next": [
            {
               "flowID": "dcc4759a-f2a4-425b-8009-4f3efbfde318",
               "logic": true,
               "order": 0,
               "tag": ""
            }
         ],
         "type": "action",
         "ui": {
            "x": -1150,
            "y": -250
         }
      },
      {
         "actionID": "66f2d1a0337caa7d6e25bac3",
         "flowID": "a7e2e4c5-c1e8-42cb-9d0b-3524c99fbac8",
         "next": [
            {
               "flowID": "933eec71-3b89-467c-bcdd-1d50fc0c7568",
               "logic": true,
               "order": 0,
               "tag": ""
            }
         ],
         "type": "action",
         "ui": {
            "x": -550,
            "y": -250
         }
      },
      {
         "actionID": "66f2d1a0fb47d262a01433d9",
         "flowID": "933eec71-3b89-467c-bcdd-1d50fc0c7568",
         "next": [
            {
               "flowID": "062743b6-47aa-41b5-9910-98151ad659b4",
               "logic": true,
               "order": 0,
               "tag": ""
            }
         ],
         "type": "action",
         "ui": {
            "x": -225,
            "y": -200
         }
      },
      {
         "actionID": "66f2d1a0337caa7d6e25bac5",
         "flowID": "062743b6-47aa-41b5-9910-98151ad659b4",
         "next": [],
         "type": "action",
         "ui": {
            "x": 50,
            "y": -200
         }
      }
   ],
   "action": {
      "66f2d19ffb47d262a01433d4": {
         "className": "sophosGetEndpoints",
         "client_id": "42d42eba-863e-45bf-af7c-2bdab213a6a4",
         "client_secret": "ENC j1 Ygn2xo2ol9OZrwgqJef/8A== oqiq6EJjnDnVBe4kVixORQ== UE7l+063DhUpCjgoWBc3GdN0YgB2zjKxw9fxl76lklZjorW6DMfI0KCqJDd8jV6f1+l90FfuqZRWWHta6kvpuB6VgYcycVmr3TDZA7uweEjwh+UmN8HY3qvsudgOXHeGQOHAI3CPVnj4Lj3err0C6H00Kozq4FDpnl3m7ii1QareauQQmMLmcZSYID6/ZrPzN0gMh4NRCe42yftFyC9zmY6nX+9TRFqVfMJtAcRLreNzcsoDEcC/SXvQBT2ptgYQQB4ZKhA58Ur1mDrWukv7VESPMn4GLc+QEYjg11zcjn9mqsMxXxIbF2W4RvbvoaGJeYB9K1ZxNZCHbY+phtXRnw== uqJ30oFGyVIx0eiWBgN6pih3KZ65Pf0fQ72Sb6kg51E7My0UFYuOZshlHMhK/M2UXPsTce5kSIRUib+qjZz47nv8Bw5quvWVuOB6wetdwDEmey7gEUrR/YEbV25OkrIwlUneAQ==",
         "comment": "",
         "connection_id": "%%data[var][sophos_connection_id]%%",
         "creationTime": 1679922886.0,
         "enabled": true,
         "lastUpdateTime": 1727189456.3848224,
         "log": false,
         "logData": false,
         "logicString": "",
         "name": "Get Endpoint",
         "objectAuthentication": false,
         "organization_id": "",
         "searchFilters": {},
         "systemCrashHandler": false,
         "tenant_id": "",
         "varDefinitions": {}
      },
      "66f2d1a0fb47d262a01433d8": {
         "className": "sophosConnect",
         "client_id": "client_id",
         "client_secret": "ENC j1 6kjfc4l3uUJBhHHjZFgnSg== C5X3KVL9F+C114QSbUunIA== GBOrBpQ8gbWsthhANCZCuuh1cO7wLnU+S+16LP06A8FLb9qgRzA419nwwA/vSbmQ729jWTiyLAdHN0YjRgqpvrL4if4z3AKvv+Q1uY9ToxfMT7By21PSPNUUCvWGThIknVz0LSAA54Fr/QS4hHPnP3ZHt849JJGc29lt4CcXlTzaIj2NMMTlwIw7AIVpapyuHmWnW94xmgZ+02HM6BoFif8BfChH97/d5iHIOS+INCFBQaNLo4G9jK7tU44Oj+5ytVxDP8iNtLfQKfg0ZcE1G1pwf6SaPwFJ9ZNTQ5FIeQGqrRrUr8aIU3oAtiuGQQWDQuEhuySKDKMtZq2uJrwg1w== PrF0GKzeniE=",
         "comment": "",
         "creationTime": 1679924057.0,
         "enabled": true,
         "lastUpdateTime": 1727189456.2847183,
         "log": false,
         "logData": false,
         "logicString": "",
         "name": "Sophos Connect",
         "organization_id": "",
         "systemCrashHandler": false,
         "tenant_id": "",
         "varDefinitions": {}
      },
      "66f2d1a0337caa7d6e25bac3": {
         "className": "forEach",
         "comment": "",
         "concurrency": 0,
         "creationTime": 1679924559.0,
         "enabled": true,
         "events": [],
         "eventsField": "%%data[action][endpoints]%%",
         "lastUpdateTime": 1727189456.358669,
         "limit": 0,
         "log": false,
         "logData": false,
         "logicString": "",
         "manual": false,
         "mergeEvents": false,
         "name": "ForEach Endpoint",
         "skip": 0,
         "systemCrashHandler": false,
         "varDefinitions": {}
      },
      "66f2d1a0fb47d262a01433d9": {
         "className": "action",
         "comment": "",
         "creationTime": 1679925189.0,
         "enabled": true,
         "lastUpdateTime": 1727189456.3358433,
         "log": false,
         "logData": false,
         "logicString": "",
         "name": "Variable Definitions",
         "systemCrashHandler": false,
         "varDefinitions": {
            "assettype": [
               {
                  "if": "if data[event][type] == \"computer\"",
                  "scope": 0,
                  "value": "workstation"
               },
               {
                  "if": "if data[event][type] == \"server\"",
                  "scope": 0,
                  "value": "server"
               },
               {
                  "scope": 0,
                  "value": ""
               }
            ],
            "associatedPerson": {
               "scope": 0,
               "value": "lower(split(data[event][associatedPerson][name],\"\\\\\",1))"
            },
            "health": {
               "scope": 0,
               "value": "data[event][health][overall]"
            },
            "host": {
               "scope": 0,
               "value": "%%lower(data[event][hostname])%%"
            },
            "id": {
               "scope": 0,
               "value": "data[event][id]"
            },
            "ip": {
               "scope": 0,
               "value": "data[event][ipv4Addresses][0]"
            },
            "lastSeen": {
               "scope": 0,
               "value": "%%datetimeToEpoch(split(data[event][lastSeenAt],\".\",0),\"%Y-%m-%dT%H:%M:%S\")%%"
            },
            "operatingSystem": [
               {
                  "if": "if \"pro\" in lower(data[event][os][name])",
                  "scope": 0,
                  "value": "%%split(lower(data[event][os][name]),\" pro\",0)%%"
               },
               {
                  "if": "if \"standard\" in lower(data[event][os][name])",
                  "scope": 0,
                  "value": "%%split(lower(data[event][os][name]),\" standard\",0)%%"
               },
               {
                  "if": "if \"datacenter\" in lower(data[event][os][name])",
                  "scope": 0,
                  "value": "%%split(lower(data[event][os][name]),\" datacenter\",0)%%"
               },
               {
                  "scope": 0,
                  "value": "%%lower(data[event][os][name])%%"
               }
            ],
            "operatingSystemBuild": {
               "scope": 0,
               "value": "data[event][os][build]"
            },
            "operatingSystemEdition": [
               {
                  "if": "if \"pro\" in lower(data[event][os][name])",
                  "scope": 0,
                  "value": "pro"
               },
               {
                  "if": "if \"standard\" in lower(data[event][os][name])",
                  "scope": 0,
                  "value": "standard"
               },
               {
                  "if": "if \"datacenter\" in lower(data[event][os][name])",
                  "scope": 0,
                  "value": "datacenter"
               },
               {
                  "scope": 0,
                  "value": ""
               }
            ],
            "status": {
               "scope": 0,
               "value": "data[event][health][services][status]"
            },
            "tamperProtectionEnabled": {
               "scope": 0,
               "value": "data[event][tamperProtectionEnabled]"
            },
            "tenant_id": {
               "scope": 0,
               "value": "data[event][tenant][id]"
            }
         }
      },
      "66f2d1a0337caa7d6e25bac5": {
         "className": "assetUpdate",
         "assetEntity": "example.local",
         "assetFields": {
            "associatedPerson": "%%data[var][associatedPerson]%%",
            "endpoint_id": "%%data[var][id]%%",
            "health": "%%data[var][health]%%",
            "ip": "%%data[var][ip]%%",
            "operatingSystem": "%%data[var][operatingSystem]%%",
            "operatingSystemBuild": "%%data[var][operatingSystemBuild]%%",
            "operatingSystemEdition": "%%data[var][operatingSystemEdition]%%",
            "status": "%%data[var][status]%%",
            "tamperProtectionEnabled": "%%data[var][tamperProtectionEnabled]%%",
            "tenant_id": "%%data[var][tenant_id]%%"
         },
         "assetName": "%%lower(data[event][hostname])%%",
         "assetType": "%%data[var][assettype]%%",
         "comment": "",
         "creationTime": 1679925216.0,
         "delayedUpdate": 0,
         "enabled": true,
         "lastUpdateTime": 1727189456.3088384,
         "log": false,
         "logData": false,
         "logicString": "",
         "mergeSource": false,
         "name": "Asset Update",
         "replaceExisting": false,
         "sourcePriority": 300,
         "sourcePriorityMaxAge": 86400,
         "systemCrashHandler": false,
         "updateSource": "sophos",
         "updateTime": "%%data[var][lastSeen]%%",
         "varDefinitions": {}
      }
   },
   "trigger": {
      "66f2d19ffb47d262a01433d3": {
         "className": "trigger",
         "comment": "",
         "concurrency": 0,
         "creationTime": 1679922293.0,
         "enabled": true,
         "executionSnapshotFullData": false,
         "failOnActionFailure": true,
         "lastUpdateTime": 1727189456.406805,
         "logicString": "",
         "maxDuration": 60,
         "name": "Start Sophos Asset flow",
         "onActionCrash": "",
         "onEnd": "",
         "onTriggerCrash": "",
         "onTriggerKilled": "",
         "schedule": "",
         "varDefinitions": {}
      }
   }
}