Sophos Central is a cloud-based security platform that provides endpoint protection and management for enterprises. The Balbix integration with Sophos ingests endpoint devices, Sophos security products, and system information from Sophos Central.
Balbix uses AI to aggregate, normalize and deduplicate ingested information, along with data integrated from your other IT and cybersecurity tools, to provide a unified view of your entire asset inventory, vulnerabilities, and business and operational context. This information is further analyzed by Balbix AI models to provide deployment gap analysis, risk-based vulnerability prioritization (with strict rank and score) and quantification of risk for a single asset, groups of assets and the entire enterprise.
Integration Summary
The table below provides information about the integration type, asset types, and data types that are fetched by the Balbix connector for Sophos.
Integration Type | Fetch: An inbound API integration used to fetch endpoint devices, Sophos security products, and system information. |
Types of Assets Fetched | Endpoint devices, workstations, servers managed by Sophos Central. |
Types of Data Fetched | Asset names, hardware information, interface information (MAC address, IP address), OS information, Sophos security product information, system information, user information, cloud provider information, MDR management status. |
Prerequisites
To configure the Balbix connector, you must first create Sophos Central API credentials with the appropriate permissions. These credentials are required for completing the configuration process
Get API Credentials
API credentials (Client ID and Client Secret) are required to access the Sophos Central API using OAuth2 authentication.
1. Log in to Sophos Central: Access your Sophos Central management console.
2. Navigate to API Credentials Management: Go to the API credentials section in your Sophos Central console.
3. Create API Credentials: Generate a new set of API credentials with the following details:
Field | Description |
Client ID | The unique identifier for your API application. Note this value as you'll need it for authentication. |
Client Secret | The secret key associated with your Client ID. Keep this secure and note it for authentication requests. |
Scope | Ensure the credentials have appropriate permissions to access endpoint data and tenant information. |
Grant Type | The credentials should support "client_credentials" grant type for OAuth2 authentication. |
4.Verify Permissions: Ensure the API credentials have the necessary permissions to:
Access tenant information (
/whoami/v1endpoint)Read endpoint data (
/endpoint/v1/endpointsendpoint)Access organization details
Create and Configure the Connector
After you have completed the prerequisites, follow these steps to create and configure your Balbix connector for Sophos.
Step 1: Select the Connector
Start by selecting a connector using the steps outlined below:
Go to Data Sources from the left navigation bar.
In the Connectors table, click + Add Connector.
Click Select a Connector to Configure to expand the window and view the list of available connectors.
Click the + icon on the Sophos tile.
Click Next to configure the connector.
Step 2: Configure the Connector
Follow this procedure to create the connector:
Software Inventory Scope
Important: The Sophos connector provides information about Sophos security products only, not a complete software inventory. The software-related fields (
sw_product_name,sw_product_version) specifically refer to:
Sophos Endpoint Protection
Sophos Intercept X
Sophos Central Device Encryption
Other Sophos security products deployed through Sophos Central
This integration does not include:
Third-party applications installed on endpoints
Operating system components (beyond basic OS information)
Custom or proprietary software
General productivity software (Office suites, browsers, etc.)
For comprehensive software inventory across all installed applications, consider using additional asset discovery tools or integrations specifically designed for software inventory management.
API Authentication Flow
The Sophos connector uses a multi-step OAuth2 authentication process:
1. Initial Authentication: Uses Client ID and Client Secret to obtain an access token from https://id.sophos.com/api/v2/oauth2/token
2. Organization Discovery: Calls /whoami/v1 on the global API (https://api.central.sophos.com) to get organization details
3. Tenant Information: Uses the organization URL and ID to get tenant-specific information and data region URL
4. Data Retrieval: Uses the tenant ID and data region URL to fetch endpoint data from the appropriate regional API
API Reference Documentation
For more information about the Sophos Central API, see the following references:
Troubleshooting
Common Issues
1. Authentication Failures
Verify Client ID and Client Secret are correct
Ensure API credentials have appropriate permissions
Check that the credentials support "client_credentials" grant type
2. No Data Retrieved
Verify the "Asset Last Seen Days Filter" is appropriate for your environment
Check that endpoints exist in your Sophos Central console
Ensure endpoints have been active within the specified time frame
3. Tenant Information Errors
Verify your API credentials have access to organization and tenant information
Check network connectivity to Sophos Central APIs
Ensure your organization is properly configured in Sophos Central
Data Filtering
The connector automatically filters endpoints based on the "lastSeenAfter" parameter (default: 30 days)
Only endpoints that have been active within the specified timeframe are retrieved
Software products with status other than "installed" are marked as ignored (
is_ignored: true)