firewall.sophos

The tags beginning with firewall.sophos identify log events generated by the Sophos Firewalls.

Since there is no facility for applying the Devo tag in the source system, the events should be forwarded to a Devo Relay to be identified, tagged, and forwarded securely to the Devo Cloud. This is done by setting up the Devo Relay as a remote syslog server in Sophos.

Tag structure

The full tag must have at least four levels. The first two are fixed as firewall.sophos. The third level identifies the log type and must be one of general, securemail, securenet, secureweb, or system. The fourth element is required and fixed depending upon the log type.

Therefore, the valid tags include:

• firewall.sophos.general.system

• firewall.sophos.securemail.smtp

• firewall.sophos.securenet.ips

• firewall.sophos.securenet.packetfilter

• firewall.sophos.secureweb.http

• firewall.sophos.system.auth

• firewall.sophos.system.confd

• firewall.sophos.system.eplog

• firewall.sophos.system.epsecd

• firewall.sophos.system.up2date

For more information, read more about Devo tags.

Devo Relay rules

You will need to define two relay rules that can correctly identify the event type and apply the corresponding tag. Rule 1 identifies the event's type by the source port that it was received on and by whether it matches a format defined by a regular expression. Rule 2 will be applied to any events that do not match the Rule 1 conditions and applies the firewall.sophos.general.system tag.

When the Rule 1 source conditions are met, the relay applies a tag that begins with firewall.sophos. A regular expression in the Source Data field describes the format of the event data. Data is extracted from the event and used to create the third and fourth levels of the tag.

Rule 1: If event format matches the Source Data regex, extract event data and append the values to the tag

• Source Port → 13003    (the port number can be any free port on your relay)
• Source Data → sys=\"([^\"]+)\" sub=\"([^\"]+)\"
• Target Tag → firewall.sophos.\\D1.\\D2
• Select the Stop Processing and Sent without syslog tag checkboxes
  

Rule 2: Apply the firewall.sophos.general.system tag to all other events received on the same port

• Source Port → 13003    (the port number can be any free port on your relay)
• Target Tag → firewall.sophos.general.system
• Select the Sent without syslog tag checkbox

Related articles

• Devo Relay
• Defining relay rules