Sophos Endpoint Protection (via Codeless Connector Platform)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | SophosEndpointProtectionCCPDefinition |
| Publisher | Microsoft |
| Used in Solutions | Sophos Endpoint Protection |
| Collection Method | CCF |
| Connector Definition Files | SophosEP_DataConnectorDefinition.json |
| DCR Definition Files | SophosEP_DCR.json |
| CCF Configuration | SophosEP_PollingConfig.json |
| CCF Capabilities | OAuth2, Paging |
| Ingestion API | Log Ingestion API — Sibling ARM template declares DCR / Log Ingestion API resources |
| Microsoft Learn | View on Learn |
The Sophos Endpoint Protection data connector provides the capability to ingest Sophos events and Sophos alerts into Microsoft Sentinel. Refer to Sophos Central Admin documentation for more information.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
SophosEPAlerts_CL |
? | ✓ | ? |
SophosEPEvents_CL |
✓ | ✓ | ✓ |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
Custom Permissions:
- Sophos Endpoint Protection API access: Access to the Sophos Endpoint Protection API through a service principal is required.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connect to Sophos Endpoint Protection API to start collecting event and alert logs in Microsoft Sentinel
Follow Sophos instructions to create a service principal with access to the Sophos API. It will need the Service Principal ReadOnly role. Through those instructions, you should get the Client ID, Client Secret, Tenant ID and data region. Fill the form bellow with that information.
- Sophos Tenant ID: Sophos Tenant ID
- Sophos Tenant Data Region: eu01, eu02, us01, us02 or us03
- OAuth Configuration:
- Client ID
- Client Secret
- Click 'Connect' to authenticate Connector Management Interface
This section is an interactive interface in the Microsoft Sentinel portal that allows you to manage your data collectors.
📊 View Existing Collectors: A management table displays all currently configured data collectors with the following information:
- Name
- ID
➕ Add New Collector: Click the "Add new collector" button to configure a new data collector (see configuration form below).
💡 Portal-Only Feature: This configuration interface is only available when viewing the connector in the Microsoft Sentinel portal. You cannot configure data collectors through this static documentation.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊