av.sophos

Overview

The tags beginning with av.sophos identify log events generated by Sophos Endpoint Security and Control. Currently Devo supports several components of this suite.

Tag structure

The full tag must have three levels. The first two are fixed as av.sophos. The third level identifies the event type and must be one of applicationcontrol, devicecontrol, enterprise, events, tamperprotection, threatinstances, or threats. These correspond to log file names as generated by Sophos. The fourth tag level is not used. 

Therefore, the valid tags include:

• av.sophos.applicationcontrol
• av.sophos.devicecontrol
• av.sophos.enterprise
• av.sophos.events
• av.sophos.tamperprotection
• av.sophos.threatinstances
• av.sophos.threats

Once the Sophos Endpoint Security and Control events are delivered to Devo, they will be accessible from the Finder in tables with the same names.

For more information, read more about Devo tags.