All Apps and Add-ons

Is there a way to pull the Sophos Audit Logs as well?

Sparky1
Explorer

If i go to Logs & Reports, in the sophos central console, under the General Logs heading there are 2 options, Events and Audit Logs. Based on the information that is polled from the Splunk Add-on only the Event Logs are polled, is there a way to receive the Audit Logs as well?

osakachan
Communicator

Hello,

Ingesting machine data from Sophos Central you will have 2 kinds of logs with 2 differents customer_id (it is only same alphanumeric but rearranged). One of them gives you extended information about one of the events with the other customer_id.

This is using this https://github.com/sophos/Sophos-Central-SIEM-Integration

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @sparky1,

Thanks for posting.

Could you give us some more context for your query? You have a much better chance of getting your question answered if you provide more information about your issue. Plus, it will help guide future community users who are facing a similar problem.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!