--- title: "Sophos Central Alerts" slug: "sophos-central-alerts" updated: 2025-03-27T14:51:15Z published: 2025-03-27T14:51:15Z canonical: "docs.databee.buzz/sophos-central-alerts" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt > Use this file to discover all available pages before exploring further. # Sophos Central Alerts The Sophos Central Alerts API provides real-time security alerts across all Sophos products, including endpoint, network, email, and cloud security. It returns details such as alert severity, affected devices, detection timestamps, and recommended actions. For detailed information refer to the [Sophos official documentation](https://www.sophos.com/en-us). **Integration Method:** API **Tables**: Detection Finding (2004) This integration supports the following events. | **Event** | **Description** | | --- | --- | | Alerts | Retrieve list of alerts | This integration supports the following versions. | Sophos Central Alerts API version | v1 | | --- | --- | > [!NOTE] > **Note:** > > We have integrated the Sophos Common API, which consolidates alerts from all Sophos products, including Endpoint, Server, and Mobile. However, each product maintains its own independent release version. There is no single unified version across all products. ## Prerequisites - The user should have access to the Sophos Central alerts portal with an account that has the Global Administrator privileges. - The user should have access to the DataBee console. ## Configuration Overview 1. Generate an API token with the required scopes 2. Add the [Sophos Central Alerts data feed](/user-manual/docs/sophos-central-alerts#databee-configuration) in the DataBee console with the below parameters. | **DataBee Parameters** | **Sophos Central Alerts Parameters** | | --- | --- | | Client Key | [Client ID](/docs/sophos-central-alerts#Client_ID) | | Client Secret | [Client Secret](/docs/sophos-central-alerts#Client_Secret) | ## Sophos Central Alerts Configuration 1. Sign in to the [Sophos Central Dashboard](https://central.sophos.com/manage/login?redirect=/dashboard). 2. Click on the **General Settings** option in the menu bar at the top right corner ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sophos-central-alerts-mar2025-image-s6ec99tr.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A22Z&se=2026-10-30T13%3A22%3A22Z&sr=c&sp=r&sig=o5u2KWxaZOYV5iZW4b6sTrl%2BQH6HKEJ7JP5w3xFSFY8%3D) 3. Click on the **API Credentials Management** option. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sophos-central-alerts-mar2025-image-7ocae2kf.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A22Z&se=2026-10-30T13%3A22%3A22Z&sr=c&sp=r&sig=o5u2KWxaZOYV5iZW4b6sTrl%2BQH6HKEJ7JP5w3xFSFY8%3D) 4. Click on **Add Credential**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sophos-central-alerts-mar2025-image-sme5e1jk.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A22Z&se=2026-10-30T13%3A22%3A22Z&sr=c&sp=r&sig=o5u2KWxaZOYV5iZW4b6sTrl%2BQH6HKEJ7JP5w3xFSFY8%3D) 5. In the “Add credential” window, confirm the following and **Add**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sophos-central-alerts-mar2025-image-95us7bsd.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A22Z&se=2026-10-30T13%3A22%3A22Z&sr=c&sp=r&sig=o5u2KWxaZOYV5iZW4b6sTrl%2BQH6HKEJ7JP5w3xFSFY8%3D) - Credential name: enter Credential name. - Description: enter description if any. - Role: select **Service Principal ReadOnly**. 6. Click on the **Show Client Secret**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sophos-central-alerts-mar2025-image-e6xqxpki.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A22Z&se=2026-10-30T13%3A22%3A22Z&sr=c&sp=r&sig=o5u2KWxaZOYV5iZW4b6sTrl%2BQH6HKEJ7JP5w3xFSFY8%3D) 7. Copy **Client ID** and **Client Secret**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/image-1743069057117.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A22Z&se=2026-10-30T13%3A22%3A22Z&sr=c&sp=r&sig=o5u2KWxaZOYV5iZW4b6sTrl%2BQH6HKEJ7JP5w3xFSFY8%3D) > [!NOTE] > **Note**: > > Copy and Save the Client details. The Client Secret cannot be shown again. These credentials will **expire in 36 months**, you will have to generate them again and update them in DataBee again. ## DataBee Configuration 1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sophos-central-alerts-mar2025-image-euqlcnvj.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A22Z&se=2026-10-30T13%3A22%3A22Z&sr=c&sp=r&sig=o5u2KWxaZOYV5iZW4b6sTrl%2BQH6HKEJ7JP5w3xFSFY8%3D) 2. Search for the **Sophos Central Alerts** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sophos-central-alerts-mar2025-image-lioz0fof.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A22Z&se=2026-10-30T13%3A22%3A22Z&sr=c&sp=r&sig=o5u2KWxaZOYV5iZW4b6sTrl%2BQH6HKEJ7JP5w3xFSFY8%3D) 3. Click on the **API Ingest** option for collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sophos-central-alerts-mar2025-image-hjddbkr2.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A22Z&se=2026-10-30T13%3A22%3A22Z&sr=c&sp=r&sig=o5u2KWxaZOYV5iZW4b6sTrl%2BQH6HKEJ7JP5w3xFSFY8%3D) 4. Enter feed contact information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sophos-central-alerts-mar2025-image-v4kxqgbv.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A22Z&se=2026-10-30T13%3A22%3A22Z&sr=c&sp=r&sig=o5u2KWxaZOYV5iZW4b6sTrl%2BQH6HKEJ7JP5w3xFSFY8%3D) 5. In the configuration page, confirm the following: ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sophos-central-alerts-mar2025-image-hxkmb9lx.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A22Z&se=2026-10-30T13%3A22%3A22Z&sr=c&sp=r&sig=o5u2KWxaZOYV5iZW4b6sTrl%2BQH6HKEJ7JP5w3xFSFY8%3D) - Authorization Method: OAuth2 - API Base URL: this is the base URL that DataBee will interact with. - Client Key: enter the [Client ID](/docs/sophos-central-alerts#Client_ID). - Client Secret: enter the [Client Secret](/docs/sophos-central-alerts#Client_Secret). - Token URL: this is the token URL. - Event Types: preselected for all the event types that integration pulls. 6. Click Submit. ## Troubleshooting Tips - Ensure the Client Key and Client Secret is pasted correctly. Since you cannot view the Client Secret after the 1st time, re-create the API credential, paste it on a text editor to ensure no spaces or unexpected characters are included and reconfigure the DataBee feed.