This repository contains a script package to export event and alert data from Sophos Central into a SIEM solution.
Any issue discovered using the script should be reported to Sophos Support.
The script in this directory allows you to use the Sophos Central API to get data into your SIEM solution.
Access to the APIs requires API Credentials that can be setup in the Sophos Central UI by going to Global Settings from the navigation bar and then selecting API Credentials Management. From this page, you can click the Add Credential button to create new credentials (client ID and client secret). Here is more information available on how to setup API Credentials: https://community.sophos.com/kb/en-us/125169
Download and extract from here for the latest release. For older version, please consult the Releases section below. For changes to the API, please consult the API Updates section below. We recommend running this script with the latest version of Python 3.7 or newer. We have tested that this program works with Python 3.6 on multiple platforms. However, support for that version of Python will be dropped when it reaches end-of-life.
See changelog for full details.
The following updates are part of an API update. They will be live for all versions of SIEM after their listed release dates.
See changelog for full details.
The script gets the last 12 hours of events on its initial run. A maximum of 24 hours of historical data can be retrieved. The script keeps tab of its state, it will always pick-up from where it left off based on a state file stored in the state folder. The script calls the server until there are no more events available. There is also a built-in retry mechanism if there are any network issues. The script exits if there are no more events available or when retry fails. In this case the next scheduled run of the script will pick-up state from the last run using the state file.
Set the SOPHOS_SIEM_HOME environment variable to point to the folder where config.ini, siem_cef_mapping.txt, state and log folders will be located. state and log folders are created when the script is run for the first time.
config.ini is a configuration file that exists by default in the siem-scripts folder.
Run python siem.py
and you should see the results as specified in the config file. Here is the list of available options:
Option | Description |
---|---|
-s \<Unix Timestamp>, --since= |
Return results since specified Unix Timestamp, max last 24 hours, defaults to last 12 hours if there is no state file |
-c \<Config File Path>, --config= |
Specify a configuration file, defaults to config.ini |
-l, --light | Ignore noisy events: web control (Event::Endpoint::WebControlViolation , Event::Endpoint::WebFilteringBlocked ), device control (Event::Endpoint::Device::AlertedOnly , Event::Endpoint::SavScanComplete ), update success/failure (Event::Endpoint::UpdateFailure , Event::Endpoint::UpdateSuccess ), application allowed (Event::Endpoint::Application::Allowed ), (non)compliant (Event::Endpoint::NonCompliant , Event::Endpoint::Compliant ) |
-d, --debug | Print debug logs |
-v, --version | Print version |
-q, --quiet | Suppress status messages. No output would be printed by siem.py |
Copyright 2016-2021 Sophos Limited
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at: LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.