Sophos Device Configuration

TABLE OF CONTENTS

• Overview
• Steps Of Integration
  • Steps to Generate API Token (Sophos Central Console)
  • Steps to Configure Sophos Central (ARIA UI)
• Verification
• Verification for CCE Server

Overview

Sophos Central is a cloud-based device that is added to the UI using API calls. This document will help you with the steps to ingest the Sophos Central with ARIA ADR to have a better visibility of threats happening in your environment.

Steps Of Integration

To add the Sophos Central support, follow the steps below.

Steps to Generate API Token (Sophos Central Console)

1. Log in to Sophos Central Console as Super Admin.
2. Navigate to Global Settings → API Token Management.
3. Select Add Token to generate new token details.
4. Copy the url, x-api-key and Authorization key from API Access URL + Headers field. You will see something like this:
   
5. Provide the url, x-api-key & Authorization key (ignore the Basic keyword) to ARIA Technical Support (aria_support@ariacybersecurity.com) or enter it in the APE screens below if you have access to the dashboard.

Steps to Configure Sophos Central (ARIA UI)

1. Go to Add-On Store → Sophos Central.
   
2. Select Add Sophos Central.
   
3. Complete the fields below.
   • 
   • Device: Select the name of the device 'Sophos Central'.
   • Name: Enter an arbitrary descriptive name.
   • CCE Host: Enter the IP Address of your CCE VM.
   • Access ID/user name: x-api-key (Exact value of this key needs to be entered. You will get it from the Sophos console).
   • Password/Secret Key: Authorization key (Exact value of this key needs to be entered. You will get it from the Sophos console).
   • Now enter the URL in valid JSON Format in the last field. Below is an example:
     • Note: This is example URL. Actual URL you will get it from Sophos central console while generating the API token.
     • {"api": "https://api5.central.sophos.com/gateway"}
4. Click Save.