Skip to main content

How to Integrate your Sophos firewall

This guide will walk you through how to get your Sophos Firewall logging to Defense.com's SIEM via your on premises collector

Kara Crimson avatar
Written by Kara Crimson
Updated over a week ago

The Sophos Firewall integration is available on our Enterprise and Advanced packages.

Before you get started

Before beginning the integration, you will need to deploy a log collector within the same network as your firewall.

To initiate the collector deployment process, please reach out to our Technical Support team, who'll provide you with a deployment pack that includes all the software and scripts needed to configure this.

If you already have a log collector deployed, please follow the steps outlined below.

Configuring your Sophos Firewall

  1. Access the Sophos Firewall management console.

    1. This can be done via Sophos Central and going to My Products > Firewall Management > Firewalls and selecting the Firewall you want to log to us.

    2. Alternatively, you can access it via the Web Admin Console by entering the IP address of the Firewall into the search bar of your web browser and entering your administrator username and password.

  2. Adding a Syslog Server.

    1. Go to System services > Log settings and click Add.

    2. Enter a name eg. Defense.com Collector.

    3. Specify the settings:

      1. IP address/domain: This should be the private IP of your log collector.

      2. Secure log transmission: This should be turned Off.

      3. Port: This should be port 5514.

      4. Facility: This should be set to DAEMON.

      5. Severity level: This should be set to Debug.

      6. Format: This should be set to Standard Syslog Protocol.

    4. Click Save.

    5. Go to Log settings and select the logs you want to send to the syslog server.

Confirming log flow

Once the above steps are complete, your device will now ship logs to our SIEM platform via your collector. You can confirm logs are successfully reaching our SIEM by either.

  1. Navigating to the Log Search feature in Defense.com by browsing to SIEM > Log Search and then filtering the logs by type:"syslog".

  2. Reaching out to our Technical Support team, who'll be able to check and confirm this for you.

And that's it! You've successfully integrated your Sophos Firewall 🎉

Did this answer your question?