Sophos XG Firewall
Sophos XG is an on-premises next-generation firewall appliance that can send its logs to InsightIDR. InsightIDR can parse the following logs:
- Firewall
- Antivirus
- Web Proxy
- IDS
You can read the admin guide here: https://docs.sophos.com/nsg/sophos-firewall/v17.0.2/PDF/Sophos%20XG%20Firewall%20Web%20Interface%20Reference%20Guide.pdf
To ensure Sophos XG forwards its log to InsightIDR, you must configure:
Configure Syslog Forwarding
You can configure your Sophos XG to forward its logs to a syslog server. Follow the instructions provided by Sophos here: https://community.sophos.com/kb/en-us/123184
For best results, use the system with the InsightIDR Collector as your syslog server location for:
- Port (where 514 is the default)
- IP Address
Additionally, choose the following options during configuration:
- Facility: DAEMON
- Severity Level: Debug
- Format: Device Standard Format
Sophos Central is the tool that allows for central management of firewall configuration. You can use the Sophos Central API to configuring log forwarding to a SIEM, or InsightIDR. Follow the directions here: https://community.sophos.com/kb/en-us/125169
Configure InsightIDR to collect data from the event source
After you complete the prerequisite steps and configure the event source to send data, you must add the event source in InsightIDR.
To configure the new event source in InsightIDR:
- From the left menu, go to Data Collection and click Setup Event Source > Add Event Source.
- Do one of the following:
- Search for Sophos XG in the event sources search bar.
- In the Product Type filter, select Firewall.
- Select the Sophos XG event source tile.
- Choose your collector and event source. If you want, you can also name your event source.
The event source Sophos XG is not the same as Sophos Firewall (UTM).
When choosing an event source from the firewall options, be sure to select the correct one.
- Choose the time zone that matches the location of your event source logs.
- Optionally choose to send unparsed logs.
- Select an attribution source.
- Configure your default domain and any advanced settings.
- Select syslog and specify the port and protocol you configured earlier.
- Optionally choose to Encrypt the event source if choosing TCP by downloading the Rapid7 Certificate.
- Click the Save button.
Verify Log Parsing
After you configure this event source, check that the Sophos XG logs appear in log search and adhere to the following format: