Wazuh sophos integration

[Jayakrishnan P]

Hi all,

I am learning to integrate Sophos API to Wazuh so that I could get logs from sophos AVs and sophos FWs. I saw scripts provided by sophos for integration with SIEMs( https://github.com/sophos/Sophos-Central-SIEM-Integration ). What I understand from the articles is that, we need to run periodically the script, with sophos API credentials, to call the sophos API. Scripts are run from the same centos7 machine as wazuh is installed (I am using wazuh ova downloaded from wazuh website and run inside virtualbox). 

    1. Is there any specific place in the centos file system from where the script should be 

        run. If needed where can I create a new folder to run the scripts. (I am very new to                  linux).?

Next thing I believe is when logs reach the wazuh server is it is stored in a text file called result.txt. 

    2. I need them to be analysed by the decoders and then by rules. It shouldn't stop it's            journey there at result.txt. How can I get this log to be decoded and trigger rules if              conditions are met?

Thanks

Jayakrishnan

[David José Iglesias Lopez]

Hello Jayakrishnan P,

1. There is no specific place, just create a scripts or sophos-scripts folder in your home directory for example.

2. Use localfile to make your Wazuh server analyze the logs: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/localfile.html?highlight=localfile

[Jayakrishnan P]

Thanks a lot David. Will do as you said

Regards

Jayakrishnan