Sophos Central

Pulls Sophos Central SIEM events and alerts, endpoints and outbreaks into the console. Theseus rules 101500 to 101571 classify them. To block addresses on a Sophos Firewall, see Sophos Firewall.

Credentials

In Sophos Central, create API credentials (Global Settings → API Credentials Management) with a role that can read events and alerts. Note the client ID, client secret, tenant ID and tenant name.

Set up

In the console, Admin → Integrations → Sophos Central:

Field	Notes
Client id
Client secret	Never shown again once saved
Tenant id
Tenant name
API host (data region)	Optional. Empty: found from the credential. A partner or organisation credential has no region of its own: set the tenant's, for example https://api-eu01.central.sophos.com

Then Test connection and Save. The test also says when the API host set is not the credential's data region. The change is applied within a minute, and events are pulled every 30 minutes.

On a stack without the console, sudo ./theseus connectors enable sophos on the server asks for the same values.

Known issue in 0.1.0

The connector reads the Sophos API host from a field setup does not fill in, so it may fail on its first fetch. Check its log after enabling it:

sudo ./theseus logs connector-sophos

If it fails, contact support.