The like filter works in all versions prior to SFOS 19.5.0 GA-Build197 and not only in IPHost search. It works in IPHostGroup, Services and other object searches. example is as follows. <Request> <Login> <Username>admin</Username> <Password>adminpassword…

Hello, can someone please help me to understand the API Documentation? I'd like to get the current ARP table of a Sophos XGS, but I'm not sure how the XML request should look like. I've found this in the documentation: https://docs.sophos.com/nsg/sophos…

Hi folks, yesterday I decided to see if what I suggested in another thread would work and that is to use the API export/import function for a restore. First fail was you still need to use the XG backup security key if you wish to performa full restore…

Hello, I want to change users of all OTP tokens on all of our firewalls because of domain change. Users with new domain already exists on the firewalls and I can change them manually via web GUI, but as we are talking about hundreds of tokens here,…

Hi @all, I'd like to disable a hardware interface with an API call, in this case I weant the WAN-interface to be disabled. Is this possible? I already managed to disable an VPN-Tunnel with this command: my-ip:port/.../APIController Account</Username…

So, I'm a little new to the Sophos XG API side of things, but I would like some guidance if possible. I need to be able to query a list of IP type hosts/services entries in an XG I have. The reason is I have over 30 IPs to add to the firewall but would…

Hello Community, for info: if there is no user on a firewall for an API call, the WebAdmin breaks down and is unreachable for about 10 minutes. The API responds with this message: <?xml version="1.0" encoding="UTF-8"?> <Response APIVersion="1900.1…

API Status Client Less Users Does Not Modify Hello guys. I hope everyone is well. I'm using the API to create a range of Client Less Users. After creating the addresses, I need to change the object's status from inactive to active. Looking at the documentation…

hello, i see in the webinar of sophos firewall acadamy 2022 an nice use-case, that we can enable and disable an ipsec connection for example enable temporary support access of our partners. After the webinar i contact the mail that was communicated…

Hi, Certificate list request ends up getting a TAR archive instead of API output. Request made is as following: <Get><Certificate><Filter key="Name" criteria="like">cert name</Filter></Certificate></Get> or <Get><Certificate></Certificate><…

Hi, Despite my positive feelings regarding Sophos products, API documentation is worst I have ever seen! It lacks very basic command explanations or examples, for example to delete the certificate it says that Name attribute is required BUT, it does…

Hi, I'm trying to get list of uploaded certificates using API to determine if the upload process required. API doc show only Add/Update or Delete certificate. Where is option to get list of certificates or get certain certificate by its name for instance…

hi Seems like in version 19 I can not use encrypted password for API access, it simply does not work. I'm getting authentication error while plain password work normally. I'm generating password using CBC 128. Is anything changed in 19? Tried native…

Hi, Is there or could Sophos provide the documentation of the protocol or API to implement a custom STAS collector ? If we could develop our own STAS collector, we could authenticate users already authenticated with a 3rd party VPN solution. …

Hello, I have a sophos xg appliance with https scanning enabled. The appliance seems to cache website's certs. Sometimes if the maintainers of website misconfigure SSL settings, a wrong certificate is served by the webserver and this gets cached…

Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment. Table of Contents Overview What to do Related information…

Hello, I integrated Sophos with Qradar using the API, it had been working till today as I'm seeing a timed out error. We didn't any change in the firewall policies. [root@invqrdraio bin]# python3 siem.py Config endpoint=/siem/v1/events, filename…

I am trying to update firewall rule with api to change the certificate. It is usefull for let's encrypt certificate update. I have followed the community suggestion to read the rule and set the values read in the update statement (obviously changing…

Hi, I am trying to generate the token using the URL " id.sophos.com/.../token " as a POST method. I got a successful result when requesting it with the POSTMAN tool. But when I request the same using java API it gives me " 400 BAD REQUEST: "{"errorCode…

Dear community, today i made a terrible experience, a customer with a few clusters in Sophos Central, using policys deployed from sophos central. I added a Firewall Rule with a new IPHost Object to one appliance manuelly and wanted to export via api…

Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment. Table of Contents Overview Exporting the Configuration…

Hello, I'm creating script for removal of inactive users from XG firewalls. I'm able to remove OTP tokens of the user, but can't remove user itself. It always returns error code 500 (Operation could not be performed on Entity.) The strange thing is…

Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment. Now onto main stuff. Script provided in this page can serve as a…

When are api tokens being deprecated in favor of OAuth2? This would be for Sophos Central. TY!!!

The script siem.py is very useful to retrieve alerts and actions on Sophos Central, but it is unable to collect data from XDR. Is it possible to "empower" it to read XDR data? SIEM would have a complete visibility on activities done on the infrastructure…