All Apps and Add-ons

Sophos Central machine group ID

craigwithers
New Member

I'm trying to write a simple search/alert in the Splunk app for Sophos Central where it will alert on any machines which have not been allocated to a Group in the Sophos console.

I've trawled through the Events and Fields, but I can't see anything that looks likely. It's perfectly possible that I'm missing something incredibly obvious, but I was hoping that someone else had ran up against something similar?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!