Sophos Endpoint Protection Data

The Sophos Central Splunk Add-on is required to collect Sophos Endpoint Protection data.

Splunkbase Download: https://splunkbase.splunk.com/app/6186/

Installation and Configuration Guide: https://community.sophos.com/sophos-integrations/w/integrations/109/splunk-add-on-for-sophos-central

How to Install and Configure the Sophos Central Add-on:

  1. Install the Add-on on the Heavy Forwarder.

  2. Configure the Add-on on the Heavy Forwarder.
    • Configure the Application.
    • Create an index named sophos or update the macro definition in the Cyences app (Settings > Configuration).
  3. Install the Add-on on the Search Head.

Note :- The “Sophos Event” and “Sophos Endpoint” inputs should be configured on the addon to leverage Sophos alerts and dashboards.

Estimated Data Size

The Sophos Central Add-on consumes around 60-80MB of license usage per day.

The total amount of data varies based on the size of your organization (our calculations are based on organizations with around thirty users and a few workstations).

Sophos Central Metadata through API

Cyences version 1.6 utilizes Sophos Central API to collect information about Sophos endpoints. The Sophos Central API data is being used in a number of places throughout the Cyences app, including the Device Inventory dashboard.

Sophos Central API Configuration

  1. Login to Sophos Central Partner portal.

  2. Click Settings & Policies.

  3. Click on the API Credentials link.

  4. Add a new set of credentials.

  5. Provide a name and description for your credential set, then click Add.

  6. Click the Copy button at the end of the Client ID.

  7. Click Show Client Secret.

  8. Refer to the Sophos Central documentation link below for further assistance.
    *https://developer.sophos.com/getting-started

Sophos Partner Portal API Configuration For A Specific Client

  1. Login to sophos Partner Portal.

  2. Click on Manage Groups.

  3. Click on Firewalls.

    alt

  4. Choose the desired Client on the Partner Portal.

  5. Click on My Products & choose General Settings from the dropdown.

  6. Click on API Credentials Managemnet.

  7. Add a new set of credentials.

  8. Provide a name and description for your credential set, then click Add.

  9. Click the Copy button at the end of the Client ID.

  10. Click Show Client Secret.

Note :- These steps represent one of the easiest methods to access all your Sophos Central dashboards for your clients on the Partner Portal.

Sophos Partner Portal API Configuration For All Clients

  1. Login to sophos Partner Portal.

  2. Click Settings & Policies.

  3. Click on the API Credentials Managemnet.

  4. Add a new set of credentials.

  5. Provide a name and description for your credential set, then click Add.

  6. Click the Copy button at the end of the Client ID.

  7. Click Show Client Secret.

Note :- Generating API credentials for all clients grants access to the data of all clients available on the partner portal.

Estimated Data Size

Data collected from Sophos will be stored in a KV Store lookup, so it will not affect your Splunk license.

Copyright © 2024 CrossRealms International.