The tags beginning with av.sophos identify log events generated by Sophos Endpoint Security and Control. Currently Devo supports several components of this suite.
The full tag must have three levels. The first two are fixed as av.sophos. The third level identifies the event type and must be one of applicationcontrol, devicecontrol, enterprise, events, tamperprotection, threatinstances, or threats. These correspond to log file names as generated by Sophos. The fourth tag level is not used.
Therefore, the valid tags include:
Once the Sophos Endpoint Security and Control events are delivered to Devo, they will be accessible from the Finder in tables with the same names.
For more information, read more about Devo tags.
These instructions are for setting up the sending of events in Sophos log files saved on a Windows machine. In this case, we can install the 2021-06-15_09-43-16_Devo Agent for Windows on the machine and forward the events directly to Devo.
Use the MagicLog component of the Devo Agent to indicate where the files are, their names, and the specific tag to attach to the events. In MagicLog, you should add a folder for each log file you are forwarding to Devo. For information about where the Sophos log files are saved, consult the Sophos Endpoint Security and Control online resources.