Sophos connector not working for API integration to Sentinel

Question

Hello,

I am trying to integrate Sophos to Sentinel using Sophos Endpoint Protection (using Azure Function) using the Option 1 as shown below,

After Clicking "Deploy to Azure" I am putting Sophos API Access URL and Header by copy pasting from "Sophos console", after putting workspace id and Shared Key correctly it's getting deployed successfully, but connector is not showing connected, and logs are also not coming in New Table.

Can someone help here what is going wrong, is there any format we have to follow to paste Sophos API Access URL and Headers?

Note: From same Sophos we are already forwarding the logs to Syslog server and from there to Sentinel. Is the possible reason API integration not working to new workspace ?

Answer 1

@Anonymous ,

Are you seeing logs in the Sentinel workspace? If so, it's possible that everything is configured correctly except the data connector. The Sophos connector has a parser to ensure the data is parsed for easily leveraging in Microsoft Sentinel workbooks and other features. The data connector depends on the parser based on a Kusto Function to work as expected. Can you check if you have installed the Kusto Function for this data connector at SophosEPEvent ?

https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/sophos-endpoint-protection-using-azure-functions#vendor-installation-instructions

If you've already done this, you can also confirm the following:

• Check that the workspace ID and shared key are correct. I noticed in your screenshot that they seem to be getting stripped?
• Make sure the API Access URL and Header are copied correctly from Sophos Central.
• Confirm that the Azure Function app is running and that there aren't any errors or warnings in the Azure Portal logs.
• Verify that the logs are being sent to the correct Log Analytics table.

Let me know if this helps and if you still face this issue.

If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions. Otherwise let me know if you have further questions.