Sophos Central Alerts

Sophos Email Protect is a cloud-based email security solution designed to protect against malware, phishing, and spam. Alerts and events are centralized through Sophos Central Alerts. It offers advanced threat protection by scanning inbound and outbound emails, blocking malicious links and attachments, and providing anti-spoofing features.

Integration Method: API

Tables: Alert

This integration has been tested against the Sophos email Protection version 2024.39

Sophos Central Alerts Configuration

To use the integration, you will need to get a client credentials.  

1. Login to the Sophos central console

2. Click on General settings button

3. Click on API Credentials Management

4. Click on Add Credentials button
    

5. Add Credential name and description. Select Service principle ReadOnly in role.

6. Click on add button

7. Copy client ID and Client secret

DataBee Configuration

1. Log into the DataBee console, navigate to Data>Datasources and click on Add New Data Source.

2. Search for Sophos central Alerts and click it

3. Select API Ingest

4. Enter contact information

5. In the configuration page, enter the following:

   • Authorization Method: OAuth2

   • Client Key: Paste the client id generated earlier

   • Client Secret: Paste the client secret generated earlier

   • Click Submit