Sophos Central - logs FW

Hello Gustavo Moreira ,

Thanks for reaching out to Sophos Community.

Could you confirm if you have tried to followed this KBA: https://support.sophos.com/support/s/article/KB-000036372?language=en_US - Sophos Central APIs: Send alert and event data to your SIEM.

For Client VPN, client connections event type are not yet available. Only 'VPN tunnel down' and 'VPN Tunnel restored' as of the moment. https://doc.sophos.com/central/Customer/help/en-us/ManageYourProducts/Alerts/FirewallAlerts/index.html#connectivity

You may reach out to Sophos Support to have this feature requested and be linked under your account registered with Sophos.

Many thanks for your time and patience and thank you for choosing Sophos.

Hello Gustavo Moreira ,

Thanks for reaching out to Sophos Community.

Could you confirm if you have tried to followed this KBA: https://support.sophos.com/support/s/article/KB-000036372?language=en_US - Sophos Central APIs: Send alert and event data to your SIEM.

For Client VPN, client connections event type are not yet available. Only 'VPN tunnel down' and 'VPN Tunnel restored' as of the moment. https://doc.sophos.com/central/Customer/help/en-us/ManageYourProducts/Alerts/FirewallAlerts/index.html#connectivity

You may reach out to Sophos Support to have this feature requested and be linked under your account registered with Sophos.

Many thanks for your time and patience and thank you for choosing Sophos.

Raphael Alganes, thanks for the response.

This was exactly the information I needed to know.

Regarding the first item, yes, I did the entire procedure.

Regarding the second item, let's share the syslog via VPN, I believe that will solve my problem.

Hello Gustavo,

Thanks for taking the time to update. Glad to know we have provided the information you needed. 

Thanks for your time and patience and thank you for choosing Sophos.

Cheers,