With a configured connection between the AlienApp for Sophos Central on a deployed USM Anywhere Sensor and your Sophos Central environment, the predefined log collection jobs perform scheduled API queries for Sophos events or alerts. When USM Anywhere collects and analyzes the first of these, the normalized events are available on the Events page.
Required Connectivity on the USM Anywhere Sensor
An AlienApp operates through a deployed USM Anywhere Sensor. In order to use the AlienApp for Sophos Central, there is an additional port that you must open on the sensor to support its functions.
|443||api1.central.sophos.com/gateway/siem/v1/events||Collect event data from Sophos Central|
|443||api1.central.sophos.com/gateway/siem/v1/alerts||Collect alert data from Sophos Central|
Configuration for the Sophos Central Connection
To enable AlienApp for Sophos Central functionality within USM Anywhere, you must configure the AlienApp by providing a valid Sophos Central API token. With a successful connection to your Sophos Central environment, the AlienApp for Sophos Central log collection jobs query the API every 20 minutes for event and/or alert information. It parses all collected data and displays it as Events and Alarms in USM Anywhere.
As a Sophos Central administrator, you must create the API token to be used by the AlienApp for the connection to your Sophos Central data through the Sophos Central APIs. The token is valid for one year. To maintain the USM Anywhere connection, you will need to renew the token to extend its validity.
To add an API token for Sophos Central
- Log in to your Sophos Central environment and select Global Settings.
- In the Administration section of the page, click API Token Management.
- On the top-right corner of the page, click Add Token.
Enter a name for the token, such as usm-anywhere.
Sophos Central displays a summary page for the generated token, including the URL and header information used to access the APIs with the token.
On the right of the API Access URL + Headers box, click Copy.
(Optional.) If needed, store the value in a secure location so that it is available for configuring the AlienApp for Sophos Central connection.
If you plan to immediately configure the AlienApp for Sophos Central connection on the same system, you can simply leave the value in your clipboard.
After you create the API token in Sophos Central, you can configure the connection within USM Anywhere.
To enable the AlienApp for Sophos Central connection
- In USM Anywhere, go to Data Sources > Integrations.
- Click the AlienApps tab.
On the AlienApps page, click the Sophos Central tile.
If you have more than one deployed USM Anywhere Sensor, select the sensor that you want to use for the enabled AlienApp.
AlienApps operate through a deployed sensor and use APIs to integrate with the connected third-party technology. Select the sensor that can access the integration endpoint. The HTTPS connections to the API will originate from this sensor.
- Click the Settings tab.
Click Change Sophos Central API Access URL + Headers.
- Enter the API token you copied from Sophos Central.
(Optional.) Modify the data options for log collection.
The Collect Sophos Central events and Collect Sophos Central alerts options are selected by default. You can clear either of these selections to limit the data collection from your Sophos Central environment.
- Click Save.
Click the Status tab to verify the connection.
After USM Anywhere completes a successful connection to the Sophos Central APIs, this tab displays the icon in the Health column for the AlienApp.
If the icon appears, there is a problem with the connection. The Message column provides information about the issue. Repeat the steps to fix the configuration or troubleshoot your Sophos Central connection.