I am interested in logging whenever one of our system admins installs or removes SEP on a client machine (or whenever a new machine is joined/moved/removed in SEC). I'm aware of the Sophos Reporting Interface - and I use it to send Sophos logs to Graylog…