90 Day Reporting Limit

Question

Hi all, 
 My organization has been using Sophos Central (aka cloud.sophos.com) for a little over a year now after migrating to it from the on-premise Manager. I have only now noticed that reporting is rather limited, especially historical reporting, on this platform. I see I can only draw reports on users and PCs going back 90 days. My question is, is there an extended license version I can purchase that allows more historical reporting? I find this a little silly, since surely many organizations need to draw reports of up to a year or more? Thanks in advance for any advice / replies :)

Gowtham Mani · Accepted Answer

Hi Darrian Churchill 
 The Sophos central console stores 90 days of log by default. For logs more than 90 days you can try with external logging with SIEM (Security information and event management). 
 Sophos Central has secured APIs available for customers. These allow the retrieval of event and alert data from Sophos Central, for use in other systems.The primary goal for these APIs is to allow integration with SIEM (Security Information and Event Management) solutions; the Sophos Central SIEM Integration script achieves this. 
 Please refer Sophos Central APIs: How to send alert and event data to your SIEM and Sophos Central: FAQ on SIEM