Integrating with Sophos XG Firewall

Overview 

Blumira’s modern cloud SIEM platform integrates with Sophos XG Firewalls to detect cybersecurity threats and provide an actionable response to remediate when a threat is detected.

When configured, the Blumira integration with Sophos XG Firewall appliance will stream security event logs to the Blumira service for threat detection and actionable response.

Learn more about enabling Blumira’s blocklists to block malicious source IP addresses and domains for automated threat response.

Before you begin

This integration requires a Blumira sensor to be installed before you can complete the steps below. Ensure that you complete the steps in Building a Blumira sensor with Ubuntu before you continue.

Gather the IP address of your Blumira sensor to use when configuring the external service.

To find and copy the IP address of the sensor, do the following:

1. In Blumira, navigate to Settings > Sensors.
2. Click the sensor row to open the details page.
3. Under Overview, in the Host Details box, copy the IP value.

Configuring the Syslog server

To set up the Sophos XG Firewall to send logs to Blumira’s sensor.

1. Log in to your Sophos XG Firewall.
2. Go to System Services > Log Settings.
3. Click Add to configure a syslog server.
4. In the Name box, type a name for the syslog server.
5. In the IP Address box, type the IP address of the Blumira sensor.
6. In the Port box, type 514.
7. Leave the default Facility as DAEMON, facility does not impact the Blumira Sensor generally
8. Select the Severity Level as Informational (you may want to move to Debug in the future, but Informational is a good starting point).
9. Leave the default Format as Device Standard Format.
10. Click Save.
    

Reference: Sophos Firewall: Add a syslog server

Specifying logs

Next, specify which Sophos logs to send to the Blumira sensor:

1. Go to System Services > Log Settings
2. Select all checkboxes under Syslog unless there is no need or license for one.
3. Ensure that the Log Traffic option is selected in the Firewall Rule is selected, otherwise, traffic will not be logged out.
   
4. Click Apply.