Sophos connector

The Sophos Central Connector enables secure integration with DNIF to fetch security logs, including alerts and events, for enhanced monitoring and threat detection.

Prerequisites

Before configuring the connector, ensure you have the following details from your Sophos Central account:

• Client ID – Obtained from Sophos API Token Management.
• Client Secret – Generated during API token creation.
• Tenant ID Unique identifier for your Sophos Central tenant.
• Data Region – The geographical region of your Sophos Central instance.

Obtaining API Credentials

1. Navigate to API Credentials Management:
   • Go to General Settings > API Credentials Management.
2. Create API Credentials:
   • Click Add Credentials.
   • Enter a credential name and optional description.
   • Select Service Principal Super Admin.
   • Click Save.
3. Retrieve Client Secret:
   • After saving, click Show Client Secret (it will only be shown once).
   • Copy and store it securely.
4. Retrieving Tenant ID & Data Region using API:
   • Run the following cURL commands:

curl -X POST "https://id.sophos.com/api/v2/oauth2/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials" \
-d "client_id=<ENTER CLIENT ID>" \
-d "client_secret=<ENTER CLIENT SECRET>" \
-d "scope=token"

curl -X GET "https://api.central.sophos.com/whoami/v1" \
 -H "Authorization: Bearer <ACCESS_TOKEN_RETRIEVED_FROM_ABOVE" \
 -H "Accept: application/json"

• The response will include your Tenant ID and Data Region.
• The Data Region will be in the format api-{dataRegion}.central.sophos.com. Ensure that you copy only the dataRegion part.
• For example : in01 in

{
  "id": "6c463484-2ec3-40e6-b4ec-49718fea1893",
  "idType": "tenant",
  "apiHosts": {
      "global": "https://api.central.sophos.com",
      "dataRegion": "https://api-in01.central.sophos.com"
  }
}

Configuration Guide

Enter the following configurations in the DNIF console: Click Next after entering all the required details and click Test Connection, to test the configuration.

Field Name	Description
Connector Name	A unique name for the connector
Log Types	Choose log types (Events, Alerts)
Client ID	Sophos API Client ID
Client Secret	Sophos API Client Secret
Tenant ID	Unique Sophos Tenant ID
Data Region	Sophos data region (e.g.in01).

• A Connection successful message will be displayed on a screen along with the time stamp.
• If the connection is not successful an error message will be displayed. Refer Troubleshooting Connector Validations for more details on the error message.