This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos connector not working for API integration to Sentinel

I am trying to integrate Sophos to Sentinel using Sophos Endpoint Protection (using Azure Function) using the Option 1 as shown below,

After Clicking "Deploy to Azure" I am putting Sophos API Access URL and Header by copy pasting from "Sophos console", after putting workspace id and Shared Key \ it's getting deployed successfully, but connector is not showing connected, and logs are also not coming in New Table.

Can someone help here what is going wrong, is there any format we have to follow to paste Sophos API Access URL and Headers?

Is there any issue with Sophos API integration ?,.. can you please tell me right format of API key and header that need to put in API access part?

This thread was automatically locked due to age.

0 Qoosh 10 months ago

Hi Shweta,

Thanks for reaching out to the Sophos Community Forum.

Is this the documentation you're following along with to get set up?
- Sophos Integrations - SentinelOne Singularity Endpoint

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Maxim-Sophos 10 months ago in reply to Qoosh

Qoosh It's Microsoft Sentinel, not SentinelOne. Probably this documentation: https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/sophos-endpoint-protection-using-azure-functions
Cancel
Vote Up 0 Vote Down

Cancel
0 Qoosh 10 months ago in reply to Maxim-Sophos

Thank you Maxim-Sophos !

Shweta , if you are trying to get the API Access URL and Header, you will only need to click the copy button on the right hand side as shown in the screenshot below.

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel