| Table of Contents | ||||||
|---|---|---|---|---|---|---|
|
Overview
The tags beginning with av.sophos identify log events generated by Sophos Endpoint Security and Control. Currently Devo supports several components of this suite.
...
The full tag must have three levels. The first two are fixed as av.sophos. The third level identifies the event type and must be one of applicationcontrol, devicecontrol, enterprise, events, tamperprotection, threatinstances, or threats. These correspond to log file names as generated by Sophos. The fourth tag level is not used.
Technology |
|---|
Brand |
|---|
type
Type | ||
|---|---|---|
av | sophos |
|
Therefore, the valid tags include:
...
For more information, read more about Devo tags.
Configuration
These instructions are for setting up the sending of events in Sophos log files saved on a Windows machine. In this case, we can install the 2021-06-15_09-43-16_Devo Agent for Windows on the machine and forward the events directly to Devo.
Use the MagicLog component of the Devo Agent to indicate where the files are, their names, and the specific tag to attach to the events. In MagicLog, you should add a folder for each log file you are forwarding to Devo. For information about where the Sophos log files are saved, consult the Sophos Endpoint Security and Control online resources.
Related articles
...