Sophos Central Integration with Wazuh

[Sachin Singh Rana]

Hi Team,

Could you p​tegrating Sophos Central logs into Wazuh?

We have attempted the configuration, but we have been unable to successfully establish the integration. We would appreciate your guidance in troubleshooting and completing the setup.

Kindly let us know the required steps or any prerequisites that we may have missed.

Thank you for your support.

Regards,
Sachin

[Md. Nazmur Sakib]

Hi Sachin,

Configure the script to write each collected event to a log file, for example:

/var/log/sophos-central.log

You can run the script periodically using a cron job.

Once the script is writing events to the file, configure the Wazuh manager to monitor it by adding the following block to /var/ossec/etc/ossec.conf:

<localfile>

  <log_format>syslog</log_format>

  <location>/var/log/sophos-central.log</location>

</localfile>

The value of <log_format> must match the format written by the script. For example, if each event is written as a single JSON object, use:

<localfile>

  <log_format>json</log_format>

  <location>/var/log/sophos-central.json</location>

</localfile>

After updating the configuration, restart the Wazuh manager:

systemctl restart wazuh-manager

The Wazuh manager will then begin monitoring the Sophos Central log file.

Depending on the structure of the collected events, you may also need to create custom decoders and rules. If the events are valid JSON, Wazuh’s default JSON decoder may extract the fields automatically, but custom rules will probably still be required to generate meaningful alerts.

Before creating the rules, test a sample event using:

/var/ossec/bin/wazuh-logtest

You can refer to the following Wazuh documentation for additional guidance:

• Wazuh regular expression syntax

• Wazuh decoder syntax

• Wazuh rule syntax

Let me know if you need any further help.