Sophos SIEM integration

[Jayakrishnan]

Hi all

I am integrating sophos logs with wazuh using the scripts provided by Sophos. I currently do it with running the script and getting the logs into result.txt. I then configured wazuh manager to monitor this log file locally. All are working as of now. Is this the right way to do it? I have noticed in a portion in the script provided by Sophos about Syslog,

# syslog properties

# for remote address use <remoteServerIp>:<port>, for e.g. 192.1.2.3:514

# for linux local systems use /dev/log

# for MAC OSX use /var/run/syslog

# append_nul will append null at the end of log message if set to true

address = /var/run/syslog

facility = daemon

socktype = udp

append_nul = false

I didn't understand what they meant by remote address and how syslog comes in here. Can someone explain?

[Francis Timilehin Jeremiah]

Hello, Thanks for using Wazuh

You can configure the Wazuh agent to collect Sophos logs as you did or configure Sophos to send its logs to a Syslog server and then Wazuh collects the logs from the Syslog server. The remote address in this case is the IP of the Syslog server. To configure the Wazuh server to collect Syslog, check this documentation out. You will find these other links useful: 

https://www.reddit.com/r/Wazuh/comments/x9ucfm/comment/inwdfwf/?utm_source=share&utm_medium=web2x&context=3
https://groups.google.com/g/wazuh/c/_O3t1qVxeo8

[Jayakrishnan]

Thanks a lot for the information, Francis