Page Comparison

Table of Contents

maxLevel	2
type	flat

...

Resource type	Definition	Devo data tables
Alerts	Returns a list of alerts.	cloud.sophos.central.alerts
Events	Returns a list of events.	cloud.sophos.central.events

...

Rw ui tabs macro

Rw tab

title	Cloud collector

We use a piece of software called Collector Server to host and manage all our available collectors. If you want us to host this collector for you, get in touch with us and we will guide you through the configuration.

Rw tab

title	On-premise collector

Structure

The following directory structure should be created for use when running the Sophos Central collector:

Code Block

<any_directory>
└── devo-collectors/
    └── sophos-central/
        ├── certs/
        │   ├── chain.crt
        │   ├── <your_domain>.key
        │   └── <your_domain>.crt
        └── config/ 
            └── config-sophos-central.yaml

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <any directory>/devo-collectors/sophos-central/certs. Learn more about security credentials in Devo here.

Editing the config-sophos-central.yaml file

In the config-sophos-central.yaml file, replace <url>, <x_api_key>, <authentication_basic>, and <token_expire_at_ts> with the values that you got in the previous steps. The <short_unique_identifier> can have any value you choose.

Code Block

globals:
  debug: false                                                                   # Setup as True or False for debugging mode
  id: not_used
  name: sophos
  persistence:                                                                   # Persistence setup filesystem
    type: filesystem                                                             
    config:
      directory_name: state                                                      # Persistence directory
outputs:
  devo_1:                                                                       
    type: devo_platform 
    config:
      address: collector-us.devo.io                                              # Devo platform address EU (for US use: collector-us.devo.io)
      port: 443
      type: SSL
      chain: chain.crt
      cert: your_domain.crt
      key: your_domain.key
inputs:
  sophos_central:
    id: <short_unique_identifier>                                                # The value of this field will be used internally for having independent persistence areas
    enabled: true
    requests_per_second: 5                                                       # Setting up requests per second. 5 recommended.
    autoconfig:       
      enabled: true    
      refresh_interval_in_seconds: 600                                       
    credentials:                                                                 # Sophos Central API access URL. i.e. api3.central.sophos.com/gateway
      url: <url>                                                                 # Sophos Central API key
      x_api_key: <x_api_key>                                                     # Sophos Central Authentication Basic
      authentication_basic: <authentication_basic>                               # Sophos Central token expire at. Accepted format YYYY-MM-DDTHH:MM:SS.ssssssZ or Mon DD, YYYY
      token_expire_at_ts: <token_expire_at_ts> 
    services:
      alerts:
        request_period_in_seconds: 60                                            # Setting up request period in seconds.
      events:
        request_period_in_seconds: 60

Download the Docker image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image	SHA-256 hash
collector-sophos-docker-image-1.12.0.tgz	`36828ac027bf55dae15a678f734665ccd92297708981fab061ce9bce6cab7762cb7d3c3c413c4a81a73cfbbe7908a3903914e0a5a6442855c66c930dd9cad87f`

Use the following command to add the Docker image to the system:

Code Block
$ gunzip -c collector-sophos-docker-image-<version>.tgz \| docker load

Info
Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace "`<version>`" with the proper value.

The Docker image can be deployed on the following services:

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/sophos-central/

Code Block

docker run \
--name collector-sophos-central \
--volume $PWD/certs:/devo-collector/certs \
--volume $PWD/config:/devo-collector/config \
--volume $PWD/state:/devo-collector/state \
--env CONFIG_FILE=config-sophos-central.yaml \
--rm -it docker.devo.internal/collector/sophos-central:<version>

Note
Replace `<version>` with the proper value.

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/sophos-central/ directory.

Code Block

version: '3'
services:
  collector-sophos-central:
    build:
      context: .
      dockerfile: Dockerfile
    image: docker.devo.internal/collector/sophos-central:${IMAGE_VERSION:-latest}
    container_name: sophos-central-collector
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./state:/devo-collector/state
    environment:
      - CONFIG_FILE=${CONFIG_FILE:-config-sophos-central.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/sophos-central directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d

Note
Replace `<version>` with the proper value.

...

Versions Compared

Old Version 5

New Version 6

Key

Structure

Devo credentials

Editing the config-sophos-central.yaml file

Download the Docker image

Docker

Docker Compose