Sophos Logs are not showing in Wazuh
Sayontani Bose
Francisco Navarro
Greetings,
Apparently it seems that everything is correct, let's see if we can find where the problem is. Foremost, when you say that your logs are not showing in Wazuh, I understand that they don't appear in our Kibana app, right? Wazuh log data collection works by generating alerts based on rules and decoders for relevant events in your endpoints. Even if Wazuh Manager is receiving the logs and analyzing them, these logs could be ignored if they don't trigger any rule which marks them as important! For more information about how does Wazuh log data collection works, read https://documentation.wazuh.com/3.13/user-manual/capabilities/log-data-collection/how-it-works.html
Also, it is interesting to use the `ossec-logtest` tool to check if your logs are being correctly decoded. Read https://documentation.wazuh.com/3.13/user-manual/reference/tools/ossec-logtest.html for more information.
That said, Wazuh has a simple decoder and some rules for Sophos antivirus, you could check them here: https://github.com/wazuh/wazuh-ruleset/blob/317052199f751e5ea936730710b71b27fdfe2914/decoders/0300-sophos_decoders.xml and https://github.com/wazuh/wazuh-ruleset/blob/317052199f751e5ea936730710b71b27fdfe2914/rules/0415-sophos_rules.xml
If you examine them, you will presumably see why you're not "seeing your logs." The default rules for Sophos are reasonably simple, and they just alert you from service start or completed scanning. I could help you to write a simple rule to create alerts for all incoming logs and then, If you wish, you could create more specific children's rules for that one. The log format could vary between versions of Sophos and according to what you're logging. If you share with us some of the logs of your `result.txt` file it would be easier to help you to create the required decoders or alerts.
What I would recommend you from there: if you want to be sure that your logs are reaching the manager, temporarily enable the "logall" parameter in the manager configuration so all the received logs will be stored in /var/ossec/logs/archvies/archives.log, if your logs appear there, they are being analyzed by Wazuh Manager. (Note: please remember to disable this option to avoid wasting disk space with duplicated logs.). Then, after making sure your logs are analyzed, try to pass one to ossec-logtest as described in our documentation to see if it matches with any decoder or rule. If not, you will need to write some custom rules and decoders, See https://documentation.wazuh.com/3.13/user-manual/ruleset/custom.html for a complete guide on how to do that. Also, I invite you to share with us some examples of your logs (anonymized) and your objectives, so we could make some example rules/decoders for you.
I hope this helps you to better understand what's going on.
Best regards,
Sayontani Bose
Francisco Navarro
Sayontani Bose
Namdev Pawar
Emerson Silva
I had the same problem as above, I ran sophos SIEM integration, it downloaded the logs in the format below
Emerson Silva
For documentation
