sophos Sophos-Central-SIEM-Integration issues

sophos / Sophos-Central-SIEM-Integration

Simple integration script for 3rd party systems such as SIEMs. Offers command line, file or syslog output in CEF, JSON or key-value pair formats.

121 stars 70 forks source link

issues

Newest

Newest Most commented Recently updated Oldest Least commented Least recently updated

When pulling out events for a hostname it changes the characters from _ into -

#92 Yenz24 opened 7 months ago
0
Question | Is it possible obtain Hash from EDR using this tool?

#91 sr-vazkez opened 11 months ago
0
Facility Number

#90 knumbness opened 1 year ago
0
Remove the facility number from logs while using syslog

#89 wildborn opened 1 year ago
0
errors when running siem.py script

#88 dianabogdan opened 1 year ago
1
Add a new jsonarray format for single use

#87 pspurr-sophos closed 1 year ago
0
Siem event and alert log collect not work

#86 Sue1990 opened 1 year ago
0
time difference between the Log Source Time and the Storage time

#85 Mathangee opened 1 year ago
0
Logging fixes

#84 garnser closed 1 year ago
1
Insufficient Logging from tool

#83 marinhms opened 2 years ago
1
the script pull the logs to the local server but not send them to my siem collector

#82 ithamar21 opened 2 years ago
2
Remove the facility number on TCP

#81 paminhoff closed 2 years ago
8
Added the configuration parameter for converting dhost to valid fqdn value.

#80 anil-sophos closed 2 years ago
0
fix for duplicate alert logs when 'endpoint = all'

#79 ruhul-sophos closed 2 years ago
0
No new alerts data retrieved from the API and empty result.txt

#78 Jaquar007 opened 2 years ago
0
Added the alert/event cursor value mimic configuration

#77 anil-sophos closed 2 years ago
0
Update siem.py version string to match release

#76 rave-net closed 2 years ago
1
2.1.0 siem.py -v still reports as 2.0.1

#75 rave-net closed 2 years ago
1
Include audit into downloaded events

#74 backloop-biz opened 2 years ago
2
Multitenant capability and Syslog

#73 LukyLuke opened 2 years ago
3
Added collection_delay configuration to fix missing event issue

#72 anil-sophos closed 2 years ago
1
Using environment vars in config.ini

#71 KrisMacBP opened 2 years ago
1
Allow skipping null byte getting appended in syslog message

#70 ruhul-sophos closed 2 years ago
3
Add delay in the data collection to avoid missing events issue.

#69 VatsalJagani closed 2 years ago
8
null_byte appended by syslog logger not supported in all siem

#68 BibekShrestha opened 2 years ago
0
Update docs to prep for 2.1.0 release

#67 ramksophos closed 2 years ago
0
Script not respecting state file

#66 ecollins-sophos opened 2 years ago
1
[Feature/CPLAT-37648] Validate the dhost value and convert to valid fqdn format when dhost not contain valid fqdn value

#65 anil-sophos closed 2 years ago
0
CPLAT-36154 : create get since time only if siem_sophos.json not available

#64 msonagra-sophos closed 2 years ago
0
Updated the readme.md file to added command params argument description and removed the API token details.

#63 anil-sophos closed 3 years ago
0
Multi Tenant support

#62 Vetpeet closed 3 years ago
1
Update CHANGELOG.md

#61 davidrudduck closed 3 years ago
1
Update CHANGELOG.md

#60 davidrudduck closed 3 years ago
0
CPLAT-37064: Removed new line between JSON records

#59 kaushal-sophos closed 3 years ago
0
Severity Map

#58 cbxsec1 opened 3 years ago
0
Moved the args inside the while loop as per Githu suggestion

#57 anil-sophos closed 3 years ago
0
Removed the indent from write json method

#56 anil-sophos closed 3 years ago
0
Issue running into RHEAL 7

#55 kaaltech closed 3 years ago
5
Multiple API configuration in Script

#54 arjamb closed 3 years ago
1
Missing Events

#53 gautaus opened 3 years ago
6
Latest version: results not in JSON format when using API token method

#52 obpedro closed 3 years ago
9
[PLEASE_REVIEW] Updated tenant fetch api call to get all tenants by calling API multiple times

#51 anil-sophos closed 3 years ago
0
Thousands of duplicate events

#50 apreheim closed 3 years ago
7
Updated the required python version 3.7 doc string changes and added check for minimum supported Python version

#49 anil-sophos closed 3 years ago
1
Error running siem.py (invalid syntax)

#48 syunusic closed 3 years ago
8
syslog export to siem

#47 Ari-R closed 3 years ago
3
Added support in siem.py to communicate with legacy-siem service

#46 anil-sophos closed 3 years ago
1
Siem.py doesnt forward events to Syslog

#45 WinterIsCommin closed 3 years ago
1
syslog export for rapid7

#44 ethernetguru closed 3 years ago
5
Feature/cplat 29997 Updated siem.py and config.ini to communicate with legacy-siem service

#43 anil-sophos closed 3 years ago
1