Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 16 replies
  • Answers 1 answer
  • Subscribers 19 subscribers
  • Views 348840 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

List of possible log Events for SIEM integration

Danie de Jager

I need to integrate the Sophos Central events into our SIEM. I need to create regex for the type of events like:

  • Event::Endpoint::UpdateSuccess
  • Event::Endpoint::WebControlViolation

Where can I find the list of event types?



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to gdriggs

    I have not. I use syslog to send events from Sophos to my SIEM, and it works fine. My problem was that my SIEM didn't have mappings from the event ID to anything useful (like the severity, type of event, description, etc.). This was just an extract from the database to allow me to populate the SIEM.

    There's still work to do. My SIEM (Alienvault) has event types and severity, but of course they don't map one-to-one to those used by Sophos. But at least my SIEM reports now list the type of event that SOphos is seeing.

  • 0 in reply to HughFraser1

    The context here was Sophos Central API and not firewall.  I am running the Sophos API script to pull endpoint events in CEF format.  This puts them in a flat file, that I use a SIEM agent to monitor and pull in new entries.  You can also forward them a syslog output, but I'm running a 15 minute task scheduler job on the Windows server that is doing my AD Sync as well.  You just have to install Python first, then you can configure and run the script.  Everything is located here:  https://community.sophos.com/kb/en-us/125169 

  • 0 in reply to DavidGardner

    We're looking to do the same thing, we have the API script up and working and our SIEM is pulling in the data.  I need to define some processing policies now though to separate out the different events.  Is there any sort of documentation that outlines what the various fields are in the log file along with possible values so I can put them into some form of context?

Unfiltered HTML