{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"4a7c0f57-709b-42c4-a35e-d1ca7cba1005"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"c39b7efb-c339-495e-b89d-ad558fb87fb8"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Service description","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"Sophos ","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.sophos.com/en-us.aspx"}}]},{"text":"is a set of cloud-native and AI-enhanced solutions that are able to adapt and evolve secure endpoints and networks against never-before-seen cybercriminal tactics and techniques. Sophos Central is the unified console for managing Sophos products.","type":"text"}]},{"type":"paragraph","content":[{"text":"The Sophos Central collector extracts Event and Alerts audit logs and sends them to Devo.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Data source description","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"The collector processes the Sophos Central API responses and sends them to the Devo platform, which will categorize all the information received on tables in your Devo domain.","type":"text"}]},{"type":"paragraph","content":[{"text":"The Sophos Central API allows to retrieve account activities for alert and event resources:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"3059c440-efcc-4bf0-bd67-8be1be21f406"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[254.0]},"content":[{"type":"paragraph","content":[{"text":"Resource type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[253.0]},"content":[{"type":"paragraph","content":[{"text":"Definition","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[253.0]},"content":[{"type":"paragraph","content":[{"text":"Devo data tables","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[254.0]},"content":[{"type":"paragraph","content":[{"text":"Alerts","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[253.0]},"content":[{"type":"paragraph","content":[{"text":"Returns a list of alerts.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#444e54"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[253.0]},"content":[{"type":"paragraph","content":[{"text":"cloud.sophos.central.alerts","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[254.0]},"content":[{"type":"paragraph","content":[{"text":"Events","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[253.0]},"content":[{"type":"paragraph","content":[{"text":"Returns a list of events.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#444e54"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[253.0]},"content":[{"type":"paragraph","content":[{"text":"cloud.sophos.central.events","type":"text"}]}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Sophos Central: API Specification and Documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://support.sophos.com/support/s/article/KB-000036424?language=en_US"}}]},{"text":" has some API schemas that you can use. Also, you can load the schemas using this ","type":"text"},{"text":"schema editor","type":"text","marks":[{"type":"link","attrs":{"href":"https://editor.swagger.io/#/"}}]},{"text":".","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Setup","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Getting the required credentials","type":"text"}]},{"type":"paragraph","content":[{"text":"You can generate and manage the required API token used for secure access to the Security Information and Event Management (SIEM) Integration API. This enables you to pull new event and alert data from Sophos Central.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"You must be a Super Admin to manage and generate API tokens.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"To add a new token:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to ","type":"text"},{"text":"Settings ","type":"text","marks":[{"type":"strong"}]},{"text":"and open the ","type":"text"},{"text":"API Token Management","type":"text","marks":[{"type":"strong"}]},{"text":" page.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Add Token","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Give the token a name and click ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"Save","type":"text","marks":[{"type":"strong"}]},{"text":". This generates the API token valid for a year.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save your ","type":"text"},{"text":"API Access URL","type":"text","marks":[{"type":"em"}]},{"text":",","type":"text"},{"text":" x-api-key,","type":"text","marks":[{"type":"em"}]},{"text":" ","type":"text"},{"text":"Authentication Basic, ","type":"text","marks":[{"type":"em"}]},{"text":"and ","type":"text"},{"text":"Expires. ","type":"text","marks":[{"type":"em"}]},{"text":"You will need them in the config file later on.","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":60.0},"content":[{"type":"media","attrs":{"width":3568,"id":"bacfc7c9-26f2-45d7-946e-34234cac1465","collection":"contentId-94657315","type":"file","height":1186}}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Run the collector","type":"text"}]},{"type":"paragraph","content":[{"text":"Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (","type":"text"},{"text":"Cloud collector","type":"text","marks":[{"type":"underline"}]},{"text":"), or deploy and host the collector in your own machine using a Docker image (","type":"text"},{"text":"On-premise collector","type":"text","marks":[{"type":"underline"}]},{"text":").","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-tabs-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"c6cc522a-a4a9-4fd3-a486-2e0b92ead8d4"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab-container.png"}}],"title":"Refined Tab Container"}},"localId":"2f1a0612-9d3c-42fa-b186-7bff98aa49c7"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"title":{"value":"Cloud collector"}},"macroMetadata":{"macroId":{"value":"6cbbfbab8f641b631f464f069a3dbd61"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"Refined Tab"}},"localId":"1a883353-d482-4c4d-a972-2913c5ed0d25"}},{"type":"paragraph","content":[{"text":"We use a piece of software called Collector Server to host and manage all our available collectors.","type":"text"}]},{"type":"paragraph","content":[{"text":"To enable the collector for a customer:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Collector Server","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"GUI","type":"text","marks":[{"type":"strong"}]},{"text":", access the ","type":"text"},{"text":"domain","type":"text","marks":[{"type":"strong"}]},{"text":" in which you want this instance to be created","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Add Collector","type":"text","marks":[{"type":"strong"}]},{"text":" and find the one you wish to add.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Version","type":"text","marks":[{"type":"strong"}]},{"text":" field, select the latest value.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Collector Name","type":"text","marks":[{"type":"strong"}]},{"text":" field, set the value you prefer (this name must be unique inside the same Collector Server domain).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the sending method select ","type":"text"},{"text":"Direct Send. Direct Send","type":"text","marks":[{"type":"strong"}]},{"text":" configuration is optional for collectors that create ","type":"text"},{"text":"Table","type":"text","marks":[{"type":"code"}]},{"text":" events, but mandatory for those that create ","type":"text"},{"text":"Lookups","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Parameters","type":"text","marks":[{"type":"strong"}]},{"text":" section, establish the ","type":"text"},{"text":"Collector Parameters","type":"text","marks":[{"type":"strong"}]},{"text":" as follows below:","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Replace the placeholders ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"3bf0a279-1f0a-4b43-996a-11f334625407"}},{"type":"code"}]},{"text":" , ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and","type":"text"},{"text":" ","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"fff07b79-df88-4e89-914d-92f0712f654a"}}]},{"text":"","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"fff07b79-df88-4e89-914d-92f0712f654a"}},{"type":"code"}]},{"text":" w","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"fff07b79-df88-4e89-914d-92f0712f654a"}}]},{"text":"ith the values obtained in previous sections of this document, except the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" that can have the value you choose.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Editing the JSON configuration","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"sophos_central\": {\n \"id\": \"\",\n \"enabled\": true,\n \"requests_per_second\": 4,\n \"autoconfig\": {\n \"enabled\": true,\n \"refresh_interval_in_seconds\": 600\n },\n \"credentials\": {\n \"url\": \"\",\n \"x_api_key\": \"\",\n \"authentication_basic\": \"\",\n \"token_expire_at_ts\": \"\"\n },\n \"services\": {\n \"alerts\": {\n \"request_period_in_seconds\": 60\n },\n \"events\": {\n \"request_period_in_seconds\": 60\n }\n }\n }\n}","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"The value chosen for the ","type":"text"},{"text":"id","type":"text","marks":[{"type":"strong"}]},{"text":" field will be used internally for having independent persistence areas.","type":"text"}]}]},{"type":"mediaSingle","attrs":{"layout":"center","width":482,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":980,"alt":"10_sophos central.png","id":"5f3b20eb-6958-495e-a8b3-b6271745029c","collection":"contentId-94657315","type":"file","height":821}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"title":{"value":"On-premise collector"}},"macroMetadata":{"macroId":{"value":"620a7c9a0627aa5e2ae6fba58ac3eb7f"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"Refined Tab"}},"localId":"d90df2ee-2557-4639-9028-ae92909e265e"}},{"type":"heading","attrs":{"level":3},"content":[{"text":"Structure","type":"text"}]},{"type":"paragraph","content":[{"text":"The following directory structure should be created for use when running the Sophos Central collector:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n└── devo-collectors/\n └── sophos-central/\n ├── certs/\n │ ├── chain.crt\n │ ├── .key\n │ └── .crt\n └── config/ \n └── config-sophos-central.yaml","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Devo credentials","type":"text"}]},{"type":"paragraph","content":[{"text":"In Devo, go to ","type":"text"},{"text":"Administration → Credentials → X.509 Certificates","type":"text","marks":[{"type":"strong"}]},{"text":", download the ","type":"text"},{"text":"Certificate","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"Private key","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"Chain CA","type":"text","marks":[{"type":"strong"}]},{"text":" and save them in ","type":"text"},{"text":"/devo-collectors/sophos-central/certs","type":"text","marks":[{"type":"code"}]},{"text":". Learn more about security credentials in Devo ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/latest/pages/94763701"}}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":950,"id":"6f45219b-2f70-49de-bcc5-c98238e26b6d","collection":"contentId-94657315","type":"file","height":448}}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Editing the config-sophos-central.yaml file","type":"text"}]},{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"config-sophos-central.yaml","type":"text","marks":[{"type":"strong"}]},{"text":" file, replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the values that you got in the previous steps. The ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" can have any value you choose.","type":"text"}]},{"type":"codeBlock","content":[{"text":"globals:\n debug: false # Setup as True or False for debugging mode\n id: not_used\n name: sophos\n persistence: # Persistence setup filesystem\n type: filesystem \n config:\n directory_name: state # Persistence directory\noutputs:\n devo_1: \n type: devo_platform \n config:\n address: collector-us.devo.io # Devo platform address EU (for US use: collector-us.devo.io)\n port: 443\n type: SSL\n chain: chain.crt\n cert: your_domain.crt\n key: your_domain.key\ninputs:\n sophos_central:\n id: # The value of this field will be used internally for having independent persistence areas\n enabled: true\n requests_per_second: 5 # Setting up requests per second. 5 recommended.\n autoconfig: \n enabled: true \n refresh_interval_in_seconds: 600 \n credentials: # Sophos Central API access URL. i.e. api3.central.sophos.com/gateway\n url: # Sophos Central API key\n x_api_key: # Sophos Central Authentication Basic\n authentication_basic: # Sophos Central token expire at. Accepted format YYYY-MM-DDTHH:MM:SS.ssssssZ or Mon DD, YYYY\n token_expire_at_ts: \n services:\n alerts:\n request_period_in_seconds: 60 # Setting up request period in seconds.\n events:\n request_period_in_seconds: 60","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Download the Docker image","type":"text"}]},{"type":"paragraph","content":[{"text":"The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"925cc6cc-4802-429d-920d-fa39544a6076"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"#c8e9f2","rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Collector Docker image","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#c8e9f2","rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"SHA-256 hash","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"collector-sophos-docker-image-1.2.0.tgz","type":"text","marks":[{"type":"link","attrs":{"href":"https://drive.google.com/file/d/1aj2jB9pWso_XrLEJ-qdvaeBUU42nGlAB/view?usp=drive_link"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"cb7d3c3c413c4a81a73cfbbe7908a3903914e0a5a6442855c66c930dd9cad87f","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Use the following command to add the Docker image to the system:","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ gunzip -c collector-sophos-docker-image-.tgz | docker load","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace \"","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":"\" with the proper value.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The Docker image can be deployed on the following services:","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Docker","type":"text"}]},{"type":"paragraph","content":[{"text":"Execute the following command on the root directory ","type":"text"},{"text":"/devo-collectors/sophos-central/","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"docker run \\\n--name collector-sophos-central \\\n--volume $PWD/certs:/devo-collector/certs \\\n--volume $PWD/config:/devo-collector/config \\\n--volume $PWD/state:/devo-collector/state \\\n--env CONFIG_FILE=config-sophos-central.yaml \\\n--rm -it docker.devo.internal/collector/sophos-central:","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the proper value.","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Docker Compose","type":"text"}]},{"type":"paragraph","content":[{"text":"The following Docker Compose file can be used to execute the Docker container. It must be created in the ","type":"text"},{"text":"/devo-collectors/sophos-central/","type":"text","marks":[{"type":"code"}]},{"text":" directory.","type":"text"}]},{"type":"codeBlock","content":[{"text":"version: '3'\nservices:\n collector-sophos-central:\n build:\n context: .\n dockerfile: Dockerfile\n image: docker.devo.internal/collector/sophos-central:${IMAGE_VERSION:-latest}\n container_name: sophos-central-collector\n volumes:\n - ./certs:/devo-collector/certs\n - ./config:/devo-collector/config\n - ./state:/devo-collector/state\n environment:\n - CONFIG_FILE=${CONFIG_FILE:-config-sophos-central.yaml}","type":"text"}]},{"type":"paragraph","content":[{"text":"To run the container using docker-compose, execute the following command from the ","type":"text"},{"text":"/devo-collectors/sophos-central","type":"text","marks":[{"type":"code"}]},{"text":" directory:","type":"text"}]},{"type":"codeBlock","content":[{"text":"IMAGE_VERSION= docker-compose up -d","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the proper value.","type":"text"}]}]}]},{"type":"paragraph"}],"version":1}

Browser not supported