search

sophos / Sophos-Central-SIEM-Integration

Simple integration script for 3rd party systems such as SIEMs. Offers command line, file or syslog output in CEF, JSON or key-value pair formats.
121 stars 70 forks source link

Multi Tenant support #62

Closed Vetpeet closed 3 years ago

Vetpeet commented 3 years ago

Hi Sophos,

Apologies if I have missed how to configure this in the config.ini but it does not appear that it this tool supports multi tenants.

Looking at the config.ini it was not clear how you would handle multi tenant credentials?

ramksophos commented 3 years ago

Hi @Vetpeet, the tool only supports one tenant at a time (tenant_id in config.ini). You can use your partner or organization level API credentials (client_id and client_secret in the config). You can get the account IDs of your tenants by calling the Partner API if you are a Sophos Partner or the Organization API if you are using enterprise API credentials.

We have an item on our roadmap to support syncing multiple tenants at a time. For now, you will need to work around it by using different config files, one per tenant.