Sophos Central SIEM API - Using the light switch to customize event outputs

Disclaimer: Please contact Sophos Professional Services if you require assistance with your specific environment.

If you’re using Sophos' default SIEM integration script and would like to select the types of events you’re retrieving, perhaps you don’t want to see application control events but would like to see endpoint non-compliant events, then you can make use of the -light switch when running the script. The light switch by default will exclude the following event types:

  • 'Event::Endpoint::NonCompliant',
  • 'Event::Endpoint::Compliant',
  • 'Event::Endpoint::Device::AlertedOnly',
  • 'Event::Endpoint::UpdateFailure',
  • 'Event::Endpoint::SavScanComplete',
  • 'Event::Endpoint::Application::Allowed',
  • 'Event::Endpoint::UpdateSuccess',
  • 'Event::Endpoint::WebControlViolation',
  • 'Event::Endpoint::WebFilteringBlocked'

You can easily edit this list and add or remove events as you see fit. You will need to edit the python script   which comes included with the Sophos Central SIEM Integration script. You should edit the last section of TYPE_HANDLERS after:

"Event::Endpoint::NonCompliant": None,    # None == ignore the event

Any event added to this list followed by None will be ignored when running the light version of the python script.

To get the list of events in Sophos Central, reference this KB

For example, if I wanted to ignore events such as PUA detections (this is just an example, I am not recommending you do this), then I would add the following entry to the list:

Event::Endpoint::CorePuaDetection: None

Save and then run the using the light switch:

Python -l

My results will ignore any Event::Endpoint::CorePuaDetection events.

You can also do the opposite and remove events from the “ignore” list by simply deleting the event record from the list. This method will allow you to customize in a very simple way a list of events you wish to retrieve using the SIEM API script.

Added TAGs
[edited by: emmosophos at 10:30 PM (GMT -7) on 13 Apr 2021]