Integrating with Sophos Central

Overview

Sophos Central is an integrated management platform to help simplify the administration of multiple Sophos products, including endpoint, mobile device management (MDM), server protection, and a secure web gateway. It helps you stop spam, phishing, malware, and data loss.

Blumira’s integration allows you to retrieve event data from Sophos Central directly to your Blumira sensor to start tracking logs for threat detection and response.

Before you begin

Before you can configure the Cloud Connector, you must gather the credentials Blumira requires to access the Sophos Central API.

To gather the Sophos credentials:

1. Log in to the Sophos Central Admin page as a Super Admin of the tenant site you want to integrate with Blumira.
   Important: If you have multiple tenants in Sophos Central, ensure that you navigate to the individual tenant that you are creating a Cloud Connector for in Blumira. Global-level credentials created in the parent partner site will fail.
2. Navigate to Global Settings > API Credentials Management.
3. Click Add credential in the top-right corner of the screen.
4. In the Add credential window, complete the following:
   1. Type a credential name to help you identify the keys as related to the Blumira integration.
   2. (Optional) Type a description.
   3. In the Role box, select Service Principle ReadOnly.
      
5. Click Add.
6. In the API credential summary, copy the Client ID and Client Secret to use in the Blumira Cloud Connector.

Configuring Blumira

Cloud Connectors automate the configuration of your integrations without requiring you to use a sensor. After you obtain your integration's configuration parameters, you can then enable Blumira to collect your logs.

To configure the Blumira Cloud Connector:

1. In the Blumira app, navigate to Settings > Cloud Connectors.
2. Click + Add Cloud Connector.
3. In the Available Cloud Connectors window, click the connector you want to add.
4. In the Cloud Connector Name box, type a name to help identify the specific integration. 
5. Enter the credentials that you collected in the previous steps.
6. Click Connect.