Skip to main content

Sophos

Visualize Sophos endpoint agents and protected devices, map agents to devices and their respective owners, and monitor changes through queries and alerts.

Installation​

info

You will need to create an API credential in the Sophos Central Admin console. See the Sophos Getting Started (Tenant) documentation for details.

Prerequisites​

  • A Sophos Central (Sophos Fusion) tenant account. This integration only accepts tenant credentials; partner and organization credentials are rejected.
  • The person creating the API credential must hold the Super Admin role in Sophos Central. While the Sophos APIs are in Preview, all access runs at the Super Admin level.

Create the API credential​

  1. Sign in to Sophos Central Admin at https://central.sophos.com/manage.
  2. Click Global Settings, then API Credentials.
  3. Click Add, supply a name and a description, then click Add.
  4. Copy the Client ID, then reveal and copy the Client Secret.

Keep the Client ID and Client Secret available for the next step.

Configuration in JupiterOne​

To install the Sophos integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Sophos. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Sophos tenant account in JupiterOne.

  • An optional Description to help identify the integration instance.

  • A Polling Interval for how frequently data is refreshed. Leave this as DISABLED to trigger runs manually.

  • Your Sophos Client ID to authenticate with the Sophos Central API.

  • Your Sophos Client Secret that pairs with the Client ID.

Click Create once all values are provided to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.