---
title: "Sophos Connector Guide"
slug: "sophos"
updated: 2026-10-22T15:02:22Z
published: 2026-10-22T15:02:22Z
canonical: "docs.safe.security/sophos"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Sophos Connector Guide

Sophos Central is a cloud-based security platform that provides endpoint protection and management for enterprises. The Balbix integration with Sophos ingests endpoint devices, Sophos security products, and system information from Sophos Central.

Balbix uses AI to aggregate, normalize and deduplicate ingested information, along with data integrated from your other IT and cybersecurity tools, to provide a unified view of your entire asset inventory, vulnerabilities, and business and operational context. This information is further analyzed by Balbix AI models to provide deployment gap analysis, risk-based vulnerability prioritization (with strict rank and score) and quantification of risk for a single asset, groups of assets and the entire enterprise.

## Integration Summary

The table below provides information about the integration type, asset types, and data types that are fetched by the Balbix connector for Sophos.

| **Integration Type** | Fetch: An inbound API integration used to fetch endpoint devices, Sophos security products, and system information. |
| --- | --- |
| **Types of Assets Fetched** | Endpoint devices, workstations, servers managed by Sophos Central. |
| **Types of Data Fetched** | Asset names, hardware information, interface information (MAC address, IP address), OS information, Sophos security product information, system information, user information, cloud provider information, MDR management status. |

## Prerequisites

To configure the Balbix connector, you must first create Sophos Central API credentials with the appropriate permissions. These credentials are required for completing the configuration process

## Get API Credentials

API credentials (Client ID and Client Secret) are required to access the Sophos Central API using OAuth2 authentication.

1. **Log in to Sophos Central**: Access your Sophos Central management console.

2. **Navigate to API Credentials Management**: Go to the API credentials section in your Sophos Central console.

3. **Create API Credentials**: Generate a new set of API credentials with the following details:

| **Field** | **Description** |
| --- | --- |
| **Client ID** | The unique identifier for your API application. Note this value as you'll need it for authentication. |
| **Client Secret** | The secret key associated with your Client ID. Keep this secure and note it for authentication requests. |
| **Scope** | Ensure the credentials have appropriate permissions to access endpoint data and tenant information. |
| **Grant Type** | The credentials should support "client_credentials" grant type for OAuth2 authentication. |

4**.Verify Permissions**: Ensure the API credentials have the necessary permissions to:

- Access tenant information (`/whoami/v1` endpoint)
- Read endpoint data (`/endpoint/v1/endpoints` endpoint)
- Access organization details

## Create and Configure the Connector

After you have completed the prerequisites, follow these steps to create and configure your Balbix connector for Sophos.

### Step 1: Select the Connector

Start by selecting a connector using the steps outlined below:

1. Go to **Data Sources** from the left navigation bar.
2. In the Connectors table, click **+ Add Connector**.
3. Click **Select a Connector to Configure** to expand the window and view the list of available connectors.
4. Click the **+** icon on the **Sophos** tile.
5. Click **Next** to configure the connector.

### Step 2: Configure the Connector

Follow this procedure to create the connector:

[Embedded content](https://scribehow.com/embed/Sophos_Connector_Guide__3Kd6USrRQoGD2EBelf4KqA?as=scrollable)

## Software Inventory Scope

> [!WARNING]
> **Important**: The Sophos connector provides information about **Sophos security products only**, not a complete software inventory. The software-related fields (`sw_product_name`, `sw_product_version`) specifically refer to:

- Sophos Endpoint Protection
- Sophos Intercept X
- Sophos Central Device Encryption
- Other Sophos security products deployed through Sophos Central

This integration **does not include**:

- Third-party applications installed on endpoints
- Operating system components (beyond basic OS information)
- Custom or proprietary software
- General productivity software (Office suites, browsers, etc.)

For comprehensive software inventory across all installed applications, consider using additional asset discovery tools or integrations specifically designed for software inventory management.

## API Authentication Flow

The Sophos connector uses a multi-step OAuth2 authentication process:

1. **Initial Authentication**: Uses Client ID and Client Secret to obtain an access token from `https://id.sophos.com/api/v2/oauth2/token`

2. **Organization Discovery**: Calls `/whoami/v1` on the global API (`https://api.central.sophos.com`) to get organization details

3. **Tenant Information**: Uses the organization URL and ID to get tenant-specific information and data region URL

4. **Data Retrieval**: Uses the tenant ID and data region URL to fetch endpoint data from the appropriate regional API

## API Reference Documentation

For more information about the Sophos Central API, see the following references:

- [Sophos Central API Documentation](https://developer.sophos.com/)
- [Sophos Central API Authentication Guide](https://developer.sophos.com/getting-started)
- [Sophos Endpoint API Reference](https://developer.sophos.com/docs/endpoint-v1/)

## Troubleshooting

**Common Issues**

1. **Authentication Failures**

- Verify Client ID and Client Secret are correct
- Ensure API credentials have appropriate permissions
- Check that the credentials support "client_credentials" grant type

2. **No Data Retrieved**

- Verify the "Asset Last Seen Days Filter" is appropriate for your environment
- Check that endpoints exist in your Sophos Central console
- Ensure endpoints have been active within the specified time frame

3. **Tenant Information Errors**

- Verify your API credentials have access to organization and tenant information
- Check network connectivity to Sophos Central APIs
- Ensure your organization is properly configured in Sophos Central

**Data Filtering**

- The connector automatically filters endpoints based on the "lastSeenAfter" parameter (default: 30 days)
- Only endpoints that have been active within the specified timeframe are retrieved
- Software products with status other than "installed" are marked as ignored (`is_ignored: true`)

##