---
title: "Sophos Central collector"
canonical: "https://docs.devo.com/space/latest/94657315/Sophos%20Central%20collector"
format: markdown
---
> Macro (toc)

## <span style="color: #172b4d">Purpose</span>

[Sophos ](https://www.sophos.com/en-us.aspx)is a set of cloud-native and AI-enhanced solutions that are able to adapt and evolve secure endpoints and networks against never-before-seen cybercriminal tactics and techniques. Sophos Central is the unified console for managing Sophos products.

The Sophos Central collector extracts Event and Alerts audit logs and sends them to Devo.

## <span style="color: #172b4d">Data source</span>

The collector processes the Sophos Central API responses and sends them to the Devo platform, which will categorize all the information received on tables in your Devo domain.

The Sophos Central API allows to retrieve account activPities for alert and event resources:

| **Resource type** | **Definition** | **API endpoint** | **Collector service name** | **Devo data tables** |
| --- | --- | --- | --- | --- |
| Alerts | <span style="color: #444e54">Returns a list of alerts.</span> | /siem/v1/alerts | alerts | cloud.sophos.central.alerts |
| Events | <span style="color: #444e54">Returns a list of events.</span> | /siem/v1/events | events | cloud.sophos.central.events |

> ⚠️ The [Sophos Central: API Specification and Documentation](https://support.sophos.com/support/s/article/KB-000036424?language=en_US) has some API schemas that you can use. Also, you can load the schemas using this [schema editor](https://editor.swagger.io/#/).

## Accepted authentication methods

The user must specify Client ID and Client Secret for authentication with Sophos central.

| **Authentication method** | **Client ID** | **Client Secret** |
| --- | --- | --- |
| Oauth v2 | REQUIRED | REQUIRED |

## Authorize it

### Getting the required credentials

You can generate and manage the required API token used for secure access to the Security Information and Event Management (SIEM) Integration API. This enables you to pull new event and alert data from Sophos Central.

> ⚠️ You must be a Super Admin to manage and generate API tokens.

To generate `client_id` and `client_secret` according to [Sophos documentation](https://developer.sophos.com/getting-started-tenant):

1. In Sophos Central Admin, go to **My Products →  General Settings →  API Credentials Management**.
2. To create a new token, click **Add Credential**.
3. Select a Credential name, select the appropriate role, add an optional description, and click **Add**. The API credential Summary for this credential is displayed.
4. Click **Show Client Secret** to show the Client Secret.
5. Copy `Client ID` and `Client Secret` from the API Credentials Management page

![10_Sophos Central collector.png](media://ef04b725-bb18-4ac6-af02-685ee48dfc7b)

6. Find the [API host URL](https://developer.sophos.com/intro#apis).  An example is `https://api-us01.central.sophos.com`.
7. Obtain the [Tenant ID from the API](https://developer.sophos.com/getting-started-tenant).

> ℹ️ Collector will use `https://id.sophos.com/api/v2/oauth2/token` to generate access_token

## Run it

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> In the Cloud Collector App, [create a Sophos Central collector instance](https://docs.devo.com/space/latest/409305131/Catalog#Create-an-instance) using this parameters template, replacing the values enclosed in `< >`. The unique ID should be a five digit number.
> 
> ```
> {
>   "inputs": {
>     "sophos_central": {
>       "id": "<short_unique_identifier>",
>       "enabled": true,
>       "base_url": "<base_url_value>",
>       "credentials": {
>         "client_id": "<CLIENT_ID>",
>         "client_secret": "<CLIENT_SECRET>",
>         "x-tenant-id": "<X_TENANT_ID>"
>       },
>       "services": {
>         "alerts": {},
>         "events": {}
>       }
>     }
>   }
> }
> ```
> 
> > Macro (rw-tab)
> 
> ### Structure
> 
> The following directory structure should be created for use when running the Sophos Central collector:
> 
> ```
> <any_directory>
> └── devo-collectors/
>     └── sophos-central/
>         ├── certs/
>         │   ├── chain.crt
>         │   ├── <your_domain>.key
>         │   └── <your_domain>.crt
>         └── config/ 
>             └── config-sophos-central.yaml
> ```
> 
> ### Devo credentials
> 
> In Devo, go to **Administration → Credentials → X.509 Certificates**, download the **Certificate**, **Private key** and **Chain CA** and save them in `<any directory>/devo-collectors/sophos-central/certs`. Learn more about security credentials in Devo [here](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94763701).
> 
> ![image](media://6f45219b-2f70-49de-bcc5-c98238e26b6d)
> 
> ### Editing the config-sophos-central.yaml file
> 
> In the **config-sophos-central.yaml** file, replace `<chain>`, `<cert>`, and `<key>` with the values that you got in the previous steps. The `<short_unique_identifier>` can have any value you choose.
> 
> ```
> globals:
>   debug: false
>   id: <collector_id>
>   name: <collector_name>
>   persistence:
>     type: filesystem
>     config:
>       directory_name: state
> 
> outputs:
>   devo_1:
>     type: devo_platform
>     config:
>       address: <devo_address>
>       port: 443
>       type: SSL
>       chain: <chain_filename>
>       cert: <cert_filename>
>       key: <key_filename>
> 
> inputs:
>   sophos_central:
>     id: <short_unique_id>
>     enabled: <input_status>
>     requests_limits:
>     - period: <request_limit_time_period_value>
>       number_of_requests: <maximum_number_of_requests_value>
>     base_url: <base_url_value>
>     credentials:
>       client_id: <client_id_value>
>       client_secret: <client_secret_value>
>       x-tenant-id: <x_tenant_id_value>
>     services:
>       alerts:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         initial_start_time_in_utc: <initial_start_time_in_utc_value>
>         override_limit: <override_limit_value>
>         override_devo_tag: <override_devo_tag_value>
>       events:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         initial_start_time_in_utc: <initial_start_time_in_utc_value>
>         override_limit: <override_limit_value>
>         override_devo_tag: <override_devo_tag_value>
> 
> ```
> 
> ### Download the Docker image
> 
> The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:
> 
> | **Collector Docker image** | **SHA-256 hash** |
> | --- | --- |
> | [collector-sophos-docker-image-2.0.0.tgz](https://drive.google.com/file/d/15_cz02K7u1CTjLmRejcwpw4XrPc_X_LY/view?usp=drive_link) | 75465b33d7fff4294970975b9dadbc35adc3914f7959954d56f508835827e17a |
> 
> Use the following command to add the Docker image to the system:
> 
> ```
> $ gunzip -c collector-sophos-docker-image-<version>.tgz | docker load
> ```
> 
> > ℹ️ Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace "`<version>`" with the proper value.
> 
> The Docker image can be deployed on the following services:
> 
> #### Docker
> 
> Execute the following command on the root directory `<any_directory>/devo-collectors/sophos-central/`
> 
> ```
> docker run \
> --name collector-sophos-central \
> --volume $PWD/certs:/devo-collector/certs \
> --volume $PWD/config:/devo-collector/config \
> --volume $PWD/state:/devo-collector/state \
> --env CONFIG_FILE=config-sophos-central.yaml \
> --rm -it docker.devo.internal/collector/sophos-central:<version>
> ```
> 
> > ⚠️ Replace `<version>` with the proper value.
> 
> #### Docker Compose
> 
> The following Docker Compose file can be used to execute the Docker container. It must be created in the `<any_directory>/devo-collectors/sophos-central/` directory.
> 
> ```
> version: '3'
> services:
>   collector-sophos-central:
>     build:
>       context: .
>       dockerfile: Dockerfile
>     image: docker.devo.internal/collector/sophos-central:${IMAGE_VERSION:-latest}
>     container_name: sophos-central-collector
>     volumes:
>       - ./certs:/devo-collector/certs
>       - ./config:/devo-collector/config
>       - ./state:/devo-collector/state
>     environment:
>       - CONFIG_FILE=${CONFIG_FILE:-config-sophos-central.yaml}
> ```
> 
> To run the container using docker-compose, execute the following command from the `<any_directory>/devo-collectors/sophos-central` directory:
> 
> ```
> IMAGE_VERSION=<version> docker-compose up -d
> ```
> 
> > ⚠️ Replace `<version>` with the proper value.

## Monitor it

Create an [inactivity alert](https://docs.devo.com/space/latest/95126785/Inactivity+alert) to detect interruptions of transfer of data from popular Microsoft products to the Microsoft 365 Management API using the query

```
from cloud.sophos.central
where toktains(hostchain,"collector-") 
select split(hostchain,"-",1) as collector_id
where eq(Workload,"alerts") or eq(Workload,"events")


```

Set the inactivity alert to keep track of the `collector_id` and `Workload`.

## Change log

| **Release** | **Release on** | **Release type** | **Details** | **Recommendation** |
| --- | --- | --- | --- | --- |
| `v2.0.0` | 4/9/2025 | [improvements] | - **Changed**   
Updated authentication mechanism using oauth v2 api  
Updated DCSDK from `1.9.0` to `1.15.0` | `Recommended version` |
| `v1.2.0` | 7/20/2023 | [improvements] | - **Changed** Updated DCSDK from `1.1.4` to `1.9.0` | `Upgrade` |