Sophos Central App For Splunk Cloud

[helixsam]

Hi,

I can't find the Sophos Central App for Splunk Cloud.
I've found the SOPHOS CENTRAL SIEM INTEGRATION on the catalog, filtering for Splunk Cloud, but is not present in the App search on my instance.
I'm on trial version, can be a license issue?

Thank you

[tbavarva]

Hi @helixsam ,
I am using this Sophos app on SH but it was created by me.

I have installed Sophos add-on for Splunk on HF. This is one way you can do.

Or if you have valid Sophos admin access with valid license, you can follow the SIEM integration guide provided in Github and do the integration.

1. There are couple of files you will have to change (config.ini and siem.py scripts for key and time params respectively).
2. Use task scheduler to get the log file in logs folder.
3. Configure inputs.conf to monitor the logs folder.

Please let me know if you need more help on this.

Regards,
Tejas

[DavidHourani]

Hi @helixsam,

Are you referring to the TA : https://splunkbase.splunk.com/app/4647/#/details

Would be best to reach out to support in case the app requires some system configuration.

Cheers,
David