Unable to fetch Sophos Central logs in Microsoft Sentinel

Question

Unable to fetch Sophos Central logs in Microsoft Sentinel

Moksh Vir 1

I want to integrate Sophos Central with Microsoft Sentinel and since there is no Data Connector for Sophos Central, I am using a Python script published by sophos in Github to fetch the Sophos logs into microsoft Sentinel. I configured the Config file with all the appropriate info but somehow after running the python script, the logs gets only stored in local file but dont get exported to Sentinel. Any suggestions on what might be wrong here?

4 answers

Your answer

Answer 1

Clive Watson 7,866 MVP Volunteer Moderator

Have you got the MMA or AMA on the server with the local file, typically an Agent will be required to send it to Sentinel - adding the link to the Sophos docs could help us see what the steps are, and what you have done so far.

Moksh Vir 1 Reputation point

2022-06-15T22:05:09.63+00:00

@Clive Watson here is the link to the supported article for this integration https://support.sophos.com/support/s/article/KB-000036372?language=en_US

In addition to this, I also tried integrating Sophos Central with microsoft Sentinel by using the Sophos Endpoint Solution published in Microsoft Content hub. I deployed the Function app using ARM template(successfully deployed) and followed the steps to connect the data connector. I saved the parser as a Function but when I try to run the function, I get the following error:

"'extend' operator: Failed to resolve table or column expression named 'SophosEP_CL' "

any idea on what the issue might be here and how can I resolve it?

Answer 2

Anonymous

I suspect thats for a product you dont have, if SophosEP_CL is missing (you can just type that name and press run in the Sentinel logs blade - if you get an error it means the table is missing probably as no logs have been sent).
The link above for the Sophos API, might be able to use the codeless connector https://learn.microsoft.com/en-us/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal

Answer 3

User989846-7900 1

Hello @Moksh Vir ,
Did you manage to get Sophos Central logs to Sentinel?

Answer 4

Moksh Vir 1

Yes, I used the python script to ingest the logs

Yanish sahu 2 Reputation points

2022-10-31T10:26:47.123+00:00

Hi Moksh, the script would be storing it in local file, how are you streaming it to sentinel?
Julie Pearl 0 Reputation points

2023-07-05T08:11:13.6366667+00:00

Hello, would you be able to share the script? Thank you.

Share via

Unable to fetch Sophos Central logs in Microsoft Sentinel

4 answers

Your answer