Sophos

Overview

This adapter allows you to connect to Sophos Central to fetch event logs.

Deployment Configurations

Adapter-specific Options

Adapter Type: sophos

• tenantid: your Sophos Central tenant ID
• clientid: your Sophos Central client ID
• clientsecret: your Sophos Central client secret
• url: your Sophos Central URL (ex: https://api-us01.central.sophos.com)

Creating Your Credentials and Getting Your Tenant ID

Sophos documentation - https://developer.sophos.com/getting-started-tenant

1. Add a new credential here
2. Get your client ID and client secret from the credentials you just created
3. Get your JWT -- be sure to replace the values with the client ID and secret from the last step

   curl -XPOST -H "Content-Type:application/x-www-form-urlencoded" -d "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&scope=token" https://id.sophos.com/api/v2/oauth2/token
   

   Response content -- grab the access_token from the output:

   {
      "access_token": "SAVE_THIS_VALUE",
      "errorCode": "success",
      "expires_in": 3600,
      "message": "OK",
      "refresh_token": "<token>",
      "token_type": "bearer",
      "trackingId": "<uuid>"
   }
   

4. Get your tenant ID -- you will need the access_token (JWT) from the last step.

   curl -XGET -H "Authorization: Bearer YOUR_JWT_HERE" https://api.central.sophos.com/whoami/v1
   

   Response content -- grab the id (tenant_id) and dataRegion (url) from the output. You will need these for your LimaCharlie Sophos adapter configuration.

   {
       "id": "57ca9a6b-885f-4e36-95ec-290548c26059",
       "idType": "tenant",
       "apiHosts": {
           "global": "https://api.central.sophos.com",
           "dataRegion": "https://api-us03.central.sophos.com"
       }
   }
   

5. Now you have all the pieces for your adapter:
   1. client_id
   2. client_secret
   3. tenant_id
   4. url

API Doc

See the official documentation.