Sophos Central Response Integration via API

Purpose

This guide explains how to configure the Sophos Central Response integration in Logsign so that Incidents and Alarms can automatically, or an analyst can manually, isolate an infected endpoint, trigger an on-demand scan, manage application allow/block lists, and run osquery-based Live Discovery queries against Sophos Central Endpoint Protection. This is not a log collection poller: it is a Response (action) integration, configured under Settings > Integrations > Responses > +Device, that lets a Logsign correlation rule or manual incident action reach out to Sophos Central and change endpoint state in real time.

This document is easy to confuse with two other, already documented, Sophos integrations in Logsign, so it is worth being explicit about the boundary. Sophos Central Integration via API and Sophos XDR Integration via API are both log collection pollers, configured under Settings > Data Collection, and their job is to pull alerts and events from Sophos into Logsign for analytics. This document covers a separate feature entirely: it does not collect any logs, it only sends action requests to Sophos Central in response to something already detected in Logsign. There is also a "Sophos Firewall Response Integration" article for the Sophos Firewall/XG product line, which is a different Sophos product (network firewall, not endpoint protection) with a different API and is unrelated to this guide.

The integration authenticates to Sophos Central using OAuth2 client credentials (a Client ID and Client Secret issued as an API Credential, sometimes called a "service principal" in Sophos's documentation). Every call first exchanges the Client ID and Client Secret for a short-lived bearer token, then calls Sophos's whoami endpoint to resolve the tenant ID and the tenant's regional data-center host, and only then issues the actual endpoint/isolation/scan/allow-block/Live Discovery request against that resolved host.

Prerequisites

• A Sophos Central tenant with Endpoint Protection (Intercept X) licensed and endpoints enrolled.
• Endpoint isolation specifically requires Intercept X Advanced with XDR or an equivalent MDR-capable license tier, per Sophos's own documentation on endpoint isolation. Accounts without this license tier are expected to be unable to use the isolation methods described below; this has not been independently confirmed against a live Logsign/Sophos pairing and should be treated as a Sophos licensing constraint to check before relying on isolation in a correlation rule.
• A Sophos Central Super Admin account (or an account with sufficient rights) to create API Credentials. See Step 1 for the specific credential role to use instead of Super Admin for the credential Logsign will actually use.
• Network connectivity from the Logsign server to id.sophos.com (token exchange) and api.central.sophos.com (tenant/region lookup), plus whatever regional API host Sophos resolves your tenant to afterward (see Notes and Limits). All of these are standard outbound HTTPS (443) calls to Sophos's public cloud; no inbound access to your network is required.
• The minimum Logsign version that ships this specific Response integration is not verified against release notes; confirm with Logsign support if you are unsure whether your installed version includes it.

Step 1: Create Sophos Central API credentials

1. Log in to Sophos Central Admin as a Super Admin.
2. Go to Global Settings > API Credentials Management (some portal versions show this as Settings & Policies > API Credentials Management). The first time you open this page you must read and accept Sophos's terms of use for API credentials.
3. Click Add Credential, give it a name and description, and choose a role.
4. After creation, Sophos shows you a Client ID and a Client Secret. Copy both immediately: the Client Secret is shown only once and cannot be retrieved again later, only rotated.

Sophos Central offers several built-in roles for API credentials. Do not default to Service Principal Super Admin for this integration; it grants full CRUD access to the entire tenant, well beyond what the methods below need.

For least privilege, use Service Principal Management if you only need endpoint visibility, isolation, scanning, and allow/block list management. Use Service Principal Forensics if you only need Live Discovery. If you need both endpoint containment actions and Live Discovery from the same Logsign device configuration, be aware that Sophos's role model assigns one role per credential; whether the Sophos Central Admin console lets you select more than one role on a single credential has not been verified here. Until that is confirmed, the safe approach is to create two separate API Credentials (one Management, one Forensics) and, if Logsign requires it, configure two separate device entries under Responses, one per credential, each used only for the method group its role covers.

Note that Logsign's connection test for this integration calls the endpoint-list method internally (see Available Methods). A Forensics-only or Read-Only credential is expected to fail that connection test even if the Live Discovery methods would work fine with it, because listing endpoints is a Management-level operation. Do not read a failed connection test on a Forensics-scoped credential as proof the credential itself is broken; see Troubleshooting.

Step 2: Configure the integration in Logsign

In Logsign, go to Settings > Integrations > Responses, search for Sophos Central, click Configure, then +Device. Fill in the following fields:

There is no Host, Base URL, or Region field to fill in. This integration does not use a fixed regional URL list: on every call it exchanges the Client ID/Client Secret for a token against id.sophos.com, then calls api.central.sophos.com/whoami/v1 with that token to resolve your tenant ID and your tenant's actual regional data-center host, and sends the underlying request to that resolved host automatically. You do not need to know or configure which Sophos data region your tenant lives in.

After saving, use Logsign's connection test on this device before relying on it in a correlation rule. The test performs an unfiltered endpoint-list call; a successful test confirms the credential can authenticate and has at least Management-level rights, but it does not confirm that isolation, scanning, or allow/block-list writes will succeed if your credential's role is more limited in some other way, and it does not exercise Live Discovery methods at all.

Available Methods

Once the device is configured, these methods become available as response actions in Incident/Alarm automation rules or as manual actions from the incident view. A number of methods that exist in comparable EDR/XDR products (alert list/get/action/search, tamper protection get/update, scan exclusions, exploit mitigation management, detected exploit list/get) are present as commented-out, disabled code in this integration and are not currently available in Logsign; do not assume they exist just because Sophos's own API supports them.

Endpoint visibility

endpoint-list

Lists endpoints in the tenant, with optional filters. Calls GET /endpoint/v1/endpoints.

endpoint-get

Retrieves details for a single endpoint. Calls GET /endpoint/v1/endpoints/{endpointId}.

Endpoint isolation (containment)

isolation-status-get

Retrieves the current isolation status of an endpoint, including when it was last isolated/released and by whom. Calls GET /endpoint/v1/endpoints/{endpointId}/isolation.

isolation-status-enabledisable

Isolates or releases an endpoint from network isolation. This is the primary containment action for this integration. Calls PATCH /endpoint/v1/endpoints/{endpointId}/isolation.

There is no separate unisolate/isolate pair of methods; the same method toggles both directions based on the isolation parameter, so a correlation rule that isolates an endpoint needs a second rule (or a manual action) calling this same method with isolation set to False to release it later. There is no built-in auto-release/expiry setting for this method.

Endpoint scan

endpoint-scan

Requests an on-demand scan on the specified endpoint. Calls POST /endpoint/v1/endpoints/{endpointId}/scans with an empty request body, so it always triggers Sophos's default scan behavior; there is no parameter to choose a quick scan versus a full scan from Logsign.

Application control: allowed items

allowed-item-list

Lists entries on the tenant's allowed-items (allowlist) settings. Calls GET /endpoint/v1/settings/allowed-items.

allowed-item-add

Adds a new entry to the allowed-items list. Calls POST /endpoint/v1/settings/allowed-items.

allowed-item-delete

Removes an entry from the allowed-items list. Calls DELETE /endpoint/v1/settings/allowed-items/{allowedItemId}.

There is no allowed-item-get or allowed-item-update method. To change an existing entry, delete it and add a new one; there is no way to view a single entry's full detail in isolation from the list call.

Application control: blocked items

blocked-item-list

Lists entries on the tenant's blocked-items (blocklist) settings. Calls GET /endpoint/v1/settings/blocked-items.

blocked-item-add

Adds a new entry to the blocked-items list, the primary "block this file/hash" containment action for this integration. Calls POST /endpoint/v1/settings/blocked-items.

blocked-item-delete

Removes an entry from the blocked-items list. Calls DELETE /endpoint/v1/settings/blocked-items/{blockedItemId}.

As with allowed items, there is no blocked-item-get or blocked-item-update method; delete and re-add to change an entry.

Live Discovery (osquery-based queries)

These four methods let Logsign browse Sophos's predefined Live Discovery query catalog and read back results of queries that were already run or scheduled inside Sophos Central. There is no method in this integration to start a new Live Discovery query run from Logsign (the underlying code has a disabled, commented-out run method); Logsign can only list existing queries/categories and read results of runs that already exist in Sophos Central.

live-discovery-queries-list

Lists available Live Discovery queries. Calls GET /live-discover/v1/queries.

live-discovery-query-categories-get

Lists the Live Discovery query categories available in the tenant. Calls GET /live-discover/v1/queries/categories. Takes no parameters.

live-discovery-query-runs-list

Lists Live Discovery query runs (past or in-progress executions). Calls GET /live-discover/v1/queries/runs.

live-discovery-query-run-result-get

Retrieves the results of a specific Live Discovery query run. Calls GET /live-discover/v1/queries/runs/{RunId}/results.

Notes and Limits

• Authentication is OAuth2 client credentials with a bearer token that Sophos issues valid for roughly one hour (per Sophos's own community documentation), followed by a whoami call to resolve the tenant ID and regional API host. Logsign requests a fresh token and repeats the whoami lookup on every single method call rather than caching and reusing a token across calls; this means every action from Logsign involves two upstream Sophos calls (token exchange, whoami) before the actual endpoint/isolation/scan/list/etc. request. This has an unverified impact on Sophos's per-credential rate limits under heavy automation usage; if you wire this integration into a very high-frequency correlation rule, monitor for 429 responses.
• Sophos enforces rate limits per API credential, per account, and per originating IP, and recommends retrying 429 responses with exponential backoff and jitter. The Go implementation behind this integration does not implement any retry or backoff logic; a 429 from Sophos is returned to Logsign as a plain failed action, with no automatic retry.
• There is no update/modify method for allowed or blocked items; only list, add, and delete exist. Changing an existing entry means deleting it and adding a replacement.
• Endpoint isolation only toggles isolation state on a single endpoint at a time; there is no bulk isolation method exposed by this integration.
• The Insecure Skip Verify field defaults to enabled in the current configuration form, meaning TLS certificate validation is skipped by default on outbound calls to Sophos. Sophos's cloud endpoints present valid public certificates, so this default is worth turning off unless you have a specific reason to keep it.
• Alert management (list/get/action/search), tamper protection get/update, scan exclusion management, exploit mitigation management, and detected exploit listing are not available through this integration even though comparable functionality exists in Sophos's own API; the underlying code has these implemented but disabled/commented out.
• This integration only covers Sophos Central Endpoint Protection response actions. It is unrelated to the Sophos Central and Sophos XDR log collection pollers, and unrelated to the separate Sophos Firewall (XG) response integration.

Troubleshooting