Sophos XDR Integration with Wazuh SIEM

Organizations often use Sophos XDR for endpoint protection and Wazuh SIEM for centralized log collection and threat monitoring. By integrating Sophos XDR with Wazuh, security teams can monitor endpoint threats, malware detections, command-and-control activities, web filtering violations, and compliance events from a single dashboard.

1. Architecture Overview

This document provides a complete step-by-step procedure to integrate Sophos XDR with Wazuh SIEM using Sophos Central APIs, Python scripts, Wazuh decoders, custom rules, and dashboard monitoring. The guide is written to allow another engineer to reproduce the implementation from scratch.

Sophos XDR Integration with Wazuh SIEM

2. Prerequisites

Infrastructure Requirements

3. Sophos Central Account Configuration

• Login to Sophos Central.
• Sophos Central Account Configuration
• Login to Sophos Central.

Navigate to:

• Global Settings → API Credentials Management
• Create a new API credential.

Provide:

• Credential Name
• Description
• Expiry Period

Save the credential.

Record:

• Client ID
• Client Secret

Navigate to Sophos Central

Step 1: Navigate to Sophos Central Log in to your Sophos Central account

Access API Credentials

Step 2: Access API Credentials Go to Global Settings → API Credentials

Set Permissions

Step 3: Set Permissions Select “Event Stream” permission

Save Credentials

Step 5: Save Credentials

Copy Client ID and Client Secret to a secure location

I have already installed wazuh

4. Wazuh Deployment

Verify Wazuh Manager Status

systemctl status wazuh-manager

Wazuh Services Running

5. Wazuh Agent Deployment

Linux Agent Installation

Install agent package.

Register agent with manager.

Start service:

systemctl start wazuh-agent

Verify:

systemctl status wazuh-agent

Linux Agent Installation

6. Obtain Tenant Information

Sophos Tenant Information

7. After generating API credentials:

Navigate to:

API Credentials → Tenant Information

Record:

• Tenant ID
• Data Region

Example:

Tenant ID: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

Region: https://api-in01.central.sophos.com

8. Download the Sophos Linux Installer

1. Log in to Sophos Central.
2. Navigate to Protect Devices → Servers.
3. Select Linux and download the installer package.
4. Copy the installer to the Kali Linux system.

Sophos Linux Installer

9. Run the Installation Script

Install the Sophos agent using the provided setup script:

sudo ./SophosSetup.sh

Run the Installation Script

10. Verify Installation Status

Check whether Sophos services are running:

systemctl status sophos-spl

Verify Installation Status

11. Confirm Device Registration

1. Log in to Sophos Central.
2. Navigate to Devices → Servers.
3. Verify that the Kali Linux endpoint appears in the device inventory.

Confirm Device Registration

Enable Real Time Protection

Enable settings Real Time Protection

Agents running Successfully

Now Wazuh & Sophos Agents are running Successfully

12. Test 1: Create EICAR Test File

The EICAR test file is a harmless antivirus test string used to verify that Sophos Endpoint Protection is functioning correctly without introducing actual malware.

Create the EICAR Test File

On the Kali Linux endpoint, create a file named eicar.com with the following content:

cat > eicar.com << 'EOF'
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
EOF

Sophos should immediately detect the EICAR test file and quarantine or delete it according to the configured policy.

Expected Result

A malware detection event for the EICAR test file is generated by Sophos, confirming that real-time protection and event reporting are functioning correctly.

Verify that the detection appears in:

• Sophos Central Dashboard
• Sophos Threat Analysis Center

Sophos Threat Analysis Center

Detected Successfully

All Good Now Its time to get sophos logs in wazuh

13. Download Integration Package from Official GitHub Page of SOPHOS

Download SIEM Integration Package from Official GitHub Page of SOPHOS

Navigate to the desired installation directory and clone the repository.

Installed SIEM Integration Package from Official GitHub

apt install git
cd /opt

git clone https://github.com/sophos/Sophos-Central-SIEM-Integration.git

cd Sophos-Central-SIEM-Integration

List the Directory

Purpose

The repository contains:

• Sophos API client
• Event collection scripts
• Configuration templates
• Syslog forwarding functionality
• State management files

14. Configure Sophos API Credentials

Edit the configuration file.

Edit the configuration file

nano config.ini

Populate the following values:

{
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "endpoint": "/siem/v1/events",
  "format": "json",
  "address": "/var/run/syslog",
  "socktype": "udp"
}

15. Verify Connectivity with Sophos Central

Run the integration manually.

Verify Connectivity with Sophos Central

cd /opt/Sophos-Central-SIEM-Integration

python3 siem.py

Successful Output

INFO Logging Level is set as: DEBUG
DEBUG fetching whoami data
DEBUG Whoami response received
INFO No new events data retrieved from the APIValidation

The following confirms:

• API authentication successful
• JWT token generated
• Tenant discovered
• Connection to Sophos Central established

16. Configure Automatic Event Polling Using Cron

Instead of running the integration continuously as a service, configure periodic execution using cron.

Edit root crontab:

crontab -e

Add:

Configure Automatic Event Polling Using Cron

*/5 * * * * cd /opt/Sophos-Central-SIEM-Integration && /usr/bin/python3 siem.py >> /var/log/sophos-siem.log 2>&1

Explanation

*/5     = Every 5 minutes
cd      = Move to integration directory
python3 = Execute Sophos collector
>>      = Append logs
2>&1    = Redirect errors to same log file

17. Verify Cron Configuration

crontab -l

Expected output:

*/5 * * * * cd /opt/Sophos-Central-SIEM-Integration && /usr/bin/python3 siem.py >> /var/log/sophos-siem.log 2>&1

18. Ensure Cron Service is Running

Check status:

Ensure Cron Service is Running

systemctl status cron

Start if necessary:

systemctl start cron
systemctl enable cron

Expected:

Active: active (running)

18. Create Sophos Integration Log File

Create the log file used by cron.

Create the log file used by cron & gave permissions.

touch /var/log/sophos-siem.log

chmod 644 /var/log/sophos-siem.log

19. Verify Cron Execution

Monitor logs:

Verify Cron Execution

tail -f /var/log/sophos-siem.log

Observed output:

INFO Logging Level is set as: DEBUG
DEBUG Fetching tenants
DEBUG Fetching JWT token
DEBUG Whoami response received
INFO No new events data retrieved from the API

20. Verification

This confirms:

• Cron job is running successfully
• API authentication successful
• Tenant discovery successful
• Sophos polling operational

21. Verify Cron Trigger in System Logs

Check cron execution history.

Verify Cron Trigger in System Logs

grep CRON /var/log/syslog | tail -20

Observed entry:

CRON CMD (cd /opt/Sophos-Central-SIEM-Integration && /usr/bin/python3 siem.py >> /var/log/sophos-siem.log 2>&1)

22. Verification

Confirms:

• Cron executes every 5 minutes
• Correct script is launched
• Logging is functioning

23. Verify Sophos State File Creation

The integration maintains a state file to avoid collecting duplicate events.

Verify Sophos State File Creation

Check:

find /opt/Sophos-Central-SIEM-Integration/state -type f

Output:

/opt/Sophos-Central-SIEM-Integration/state/siem_sophos.json

24. Verify State File Contents

Display file:

cat /opt/Sophos-Central-SIEM-Integration/state/*.json

Observed data includes:

{
  "account": {
    "jwt": "...",
    "jwtExpiresAt": "...",
    "whoami": {
      "id": "...",
      "dataRegion": "https://api-in01.central.sophos.com"
    }
  },
  "tenants": {
    "eventsLastFetched": "...",
    "lastRunAt": "..."
  }
}

25. Create Custom Decoder

File:

/var/ossec/etc/decoders/local_decoder.xml

Purpose:

Parse Sophos JSON events.

Sophos Decoder

26. Create Custom Rules

File:

/var/ossec/etc/rules/local_rules.xml

Sophos Rules

root@justinwazuh:/# cat /var/ossec/etc/rules/local_rules.xml
<!-- Local rules -->

<!-- Modify it at your will. -->
<!-- Copyright (C) 2015, Wazuh Inc. -->

<!-- Example -->
<group name="local,syslog,sshd,">

  <!--
  Dec 10 01:02:02 host sshd[1234]: Failed none for root from 1.1.1.1 port 1066 ssh2
  -->
  <rule id="100001" level="5">
    <if_sid>5716</if_sid>
    <srcip>1.1.1.1</srcip>
    <description>sshd: authentication failed from IP 1.1.1.1.</description>
    <group>authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5,</group>
  </rule>

</group>
<group name="syscheck,pci_dss_11.5,nist_800_53_SI.7,">
    <!-- Rules for Linux systems -->
    <rule id="100200" level="7">
        <if_sid>550</if_sid>
        <field name="file">/root</field>
        <description>File modified in /root directory.</description>
    </rule>
    <rule id="100201" level="7">
        <if_sid>554</if_sid>
        <field name="file">/root</field>
        <description>File added to /root directory.</description>
    </rule>
</group>
<group name="VirusTotal,">
  <rule id="100092" level="12">
    <if_sid>657</if_sid>
    <match>Successfully removed threat</match>
    <description>$(parameters.program) removed threat located at $(parameters.alert.data.virustotal.source.file)</description>
  </rule>
</group>

<group name="Sophos">

<!--Event::ADSync::Success-->

<rule id="100401" level="3">
     <decoded_as>json</decoded_as>
     <field name="type">Event::ADSync::Success</field>
     <description>Sophos XDR: ADSync Success alert</description>
  </rule>

<!--Event::Endpoint::Application::Blocked-->

<rule id="100402" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Application::Blocked</field>
     <description>Sophos XDR: Endpoint Application Blocked</description>
  </rule>

<!--Event::Endpoint::Application::Detected-->

<rule id="100403" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Application::Detected</field>
     <description>Sophos XDR: Endpoint Application Detected</description>
  </rule>

<!--Event::Endpoint::CloneDetected-->

<rule id="100404" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::CloneDetected</field>
     <description>Sophos XDR: Endpoint Clone Detected</description>
  </rule>

<!--Event::Endpoint::Compliant-->

<rule id="100405" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Compliant</field>
     <description>Sophos XDR: Endpoint Compliant</description>
  </rule>

<!--Event::Endpoint::CoreClean-->

<rule id="100406" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::CoreClean</field>
     <description>Sophos XDR: Endpoint CoreClean</description>
  </rule>

<!--Event::Endpoint::CoreDetection-->

<rule id="100407" level="12">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::CoreDetection</field>
     <description>Sophos XDR: Endpoint Core Detection</description>
  </rule>

<!--Event::Endpoint::CoreHmpaCleanNothingFound-->

<rule id="100408" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::CoreHmpaCleanNothingFound</field>
     <description>Sophos XDR: Endpoint Core HmpaCleanNothingFound</description>
  </rule>

<!--Event::Endpoint::CorePuaDetection-->

<rule id="100409" level="12">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::CorePuaDetection</field>
     <description>Sophos XDR: Endpoint Core PUA Detection</description>
  </rule>

<!--Event::Endpoint::CorePuaRestoreFailed-->

<rule id="100410" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::CorePuaRestoreFailed</field>
     <description>Sophos XDR: Endpoint Core PUA Restore Failed</description>
  </rule>

<!--Event::Endpoint::CoreReboot-->

<rule id="100411" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::CoreReboot</field>
     <description>Sophos XDR: Endpoint Core Reboot</description>
  </rule>

<!--Event::Endpoint::CoreRestoreFailed-->

<rule id="100412" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::CoreRestoreFailed</field>
     <description>Sophos XDR: Endpoint Core Restore Failed</description>
  </rule>

<!--Event::Endpoint::Device::AlertedOnly-->

<rule id="100413" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Device::AlertedOnly</field>
     <description>Sophos XDR: Endpoint Device Alerted Only</description>
  </rule>

<!--Event::Endpoint::HmpaExploitPrevented-->

<rule id="100414" level="9">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::HmpaExploitPrevented</field>
     <description>Sophos XDR: Endpoint Hmpa Exploite Prevented</description>
  </rule>

<!--Event::Endpoint::Management::Resumed-->

<rule id="100415" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Management::Resumed</field>
     <description>Sophos XDR: Endpoint Management Resumed</description>
  </rule>

<!--Event::Endpoint::Management::Suspended-->

<rule id="100416" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Management::Suspended</field>
     <description>Sophos XDR: Endpoint Management Suspended</description>
  </rule>

<!--Event::Endpoint::NonCompliant-->

<rule id="100417" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::NonCompliant</field>
     <description>Sophos XDR: Endpoint NonCompliant</description>
  </rule>

<!--Event::Endpoint::NotProtected-->

<rule id="100418" level="12">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::NotProtected</field>
     <description>Sophos XDR: Endpoint Not Protected</description>
  </rule>

<!--Event::Endpoint::OutOfDate-->

<rule id="100419" level="12">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::OutOfDate</field>
     <description>Sophos XDR: Endpoint Out of Date</description>
  </rule>

<!--Event::Endpoint::Registered-->

<rule id="100420" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Registered</field>
     <description>Sophos XDR: Endpoint Registered</description>
  </rule>

<!--Event::Endpoint::Reprotected-->

<rule id="100421" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Reprotected</field>
     <description>Sophos XDR: Endpoint Reprotected</description>
  </rule>

<!--Event::Endpoint::SavDisabled-->

<rule id="100422" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::SavDisabled</field>
     <description>Sophos XDR: Endpoint Sav Disabled</description>
  </rule>

<!--Event::Endpoint::SavEnabled-->

<rule id="100423" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::SavEnabled</field>
     <description>Sophos XDR: Endpoint Sav Enabled</description>
  </rule>

<!--Event::Endpoint::SavScanComplete-->

<rule id="100424" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::SavScanComplete</field>
     <description>Sophos XDR: Endpoint Sav Scan Complete</description>
  </rule>

<!--Event::Endpoint::ServiceNotRunning-->

<rule id="100425" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::ServiceNotRunning</field>
     <description>Sophos XDR: Endpoint Service Not Running</description>
  </rule>

<!--Event::Endpoint::ServiceRestored-->

<rule id="100426" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::ServiceRestored</field>
     <description>Sophos XDR: Endpoint Service Restored</description>
  </rule>

<!--Event::Endpoint::Threat::CleanupFailed-->

<rule id="100427" level="13">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Threat::CleanupFailed</field>
     <description>Sophos XDR: Endpoint Threat Cleanup Failed</description>
  </rule>

<!--Event::Endpoint::Threat::CommandAndControlDetected-->

<rule id="100428" level="12">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Threat::CommandAndControlDetected</field>
     <description>Sophos XDR: Endpoint Threat Command and Control Detected</description>
  </rule>

<!--Event::Endpoint::Threat::CommandAndControlDismissed-->

<rule id="100429" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Threat::CommandAndControlDismissed</field>
     <description>Sophos XDR: Endpoint Threat Command and Control Dismissed</description>
  </rule>

<!--Event::Endpoint::Threat::Detected-->

<rule id="100430" level="12">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Threat::Detected</field>
     <description>Sophos XDR: Endpoint Threat Detected</description>
  </rule>

<!--Event::Endpoint::Threat::IpsInboundDetection-->

<rule id="100431" level="12">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Threat::IpsInboundDetection</field>
     <description>Sophos XDR: Endpoint Threat IPS Inbound Detection</description>
  </rule>

<!--Event::Endpoint::Threat::PuaCleanupFailed-->

<rule id="100432" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Threat::PuaCleanupFailed</field>
     <description>Sophos XDR: Endpoint Threat PUA Cleanup Failed</description>
  </rule>

<!--Event::Endpoint::Threat::PuaDetected-->

<rule id="100433" level="12">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::Threat::PuaDetected</field>
     <description>Sophos XDR: Endpoint Threat PUA Detected</description>
  </rule>

<!--Event::Endpoint::UpdateFailure-->

<rule id="100434" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::UpdateFailure</field>
     <description>Sophos XDR: Endpoint Update Failure</description>
  </rule>

<!--Event::Endpoint::UpdateRebootRequired-->

<rule id="100435" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::UpdateRebootRequired</field>
     <description>Sophos XDR: Endpoint Update Reboot Required</description>
  </rule>

<!--Event::Endpoint::UpdateSuccess-->

<rule id="100436" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::UpdateSuccess</field>
     <description>Sophos XDR: Endpoint Update Success</description>
  </rule>

<!--Event::Endpoint::UserAutoCreated-->

<rule id="100437" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::UserAutoCreated</field>
     <description>Sophos XDR: Endpoint User Auto Created</description>
  </rule>

<!--Event::Endpoint::WebControlViolation-->

<rule id="100438" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::WebControlViolation</field>
     <description>Sophos XDR: Endpoint Web Control Violation</description>
  </rule>

<!--Event::Endpoint::WebFilteringBlocked-->

<rule id="100439" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::WebFilteringBlocked</field>
     <description>Sophos XDR: Endpoint Web Filtering Blocked</description>
  </rule>

<!--Event::Endpoint::WindowsFirewall::Blocked-->

<rule id="100440" level="5">
     <decoded_as>json</decoded_as>
     <field name="type">Event::Endpoint::WindowsFirewall::Blocked</field>
     <description>Sophos XDR: Endpoint Windows Firewall Blocked</description>
  </rule>

</group>

<!--SOPHOS XDR-->

Rule Range:

100401–100440

Events Covered:

• Threat Detected
• Malware Detected
• Command and Control
• IPS Detection
• Web Filtering
• Firewall Events
• Endpoint Compliance

27. Rule Validation

Validate rules:

/var/ossec/bin/wazuh-logtest

Paste Sophos JSON event.

Expected Result:

Rule Matched

Alert Generated

/var/ossec/bin/wazuh-logtest

{"type":"Event::Endpoint::CoreCleanFailed","severity":"medium","description":"Manual malware cleanup required"}

Validate rules

28. Generate EICAR Malware Test

Create EICAR File.

Create EICAR File

29. Verify Wazuh Detection

Navigate:

• Dashboard → Security Events

Search:

• rule.id:100406

Verify:

• Alert
• Endpoint
• Description
• Severity

Sophos should detect:

• Event::Endpoint::CoreClean

Verify detection.

Wazuh Security Event

30. Dashboard Validation

Navigate:

Dashboard → Discover

Search:

data.type

Verify all Sophos events.

Sophos Logs

Troubleshooting

If No Logs Received

Verify:

python3 sophos_alerts.py

Check:

tail -f /var/ossec/logs/sophos-alerts.json

Rules Not Triggering

Verify:

local_rules.xml

Run:

wazuh-logtest

Dashboard Empty

Verify:

systemctl status filebeat

systemctl status wazuh-indexer

systemctl status wazuh-manager

API Failure

Verify:

Client ID Client Secret Tenant ID Region

Validation

• The following commands were used to verify successful cron execution:

tail -f /var/ossec/logs/sophos_cron.log

tail -f /var/ossec/logs/sophos-alerts.json

• Verify new Sophos alerts are being collected.

tail -f /var/ossec/logs/alerts/alerts.json | grep Sophos

• Verify Wazuh is generating Sophos alerts.

21. Security Recommendations

• Rotate API credentials periodically.
• Restrict file permissions on sophos.conf.
• Monitor API failures.
• Implement alert deduplication.
• Add MITRE ATT&CK mappings.
• Enable active response where appropriate.
• Configure Teams and Shuffle integrations.

Current Status

Integration Status: Operational

Polling Method: Cron Job (Every 5 Minutes)

Authentication: Successful

Tenant Connection: Successful

State Tracking: Working

Log Generation: Working

22. Conclusion

The Sophos XDR integration successfully forwards endpoint security alerts into Wazuh SIEM using the Sophos Central API. Security analysts can investigate malware detections, command-and-control events, web violations, IPS detections, and endpoint health events from a centralized platform.This implementation provides real-time monitoring, alerting, and investigation capabilities using Wazuh SIEM.