Configure inputs for the Splunk Add-on for Sophos

To configure the inputs for the Splunk Add-on for Sophos, enable the desired stanzas in a local copy of inputs.conf on the forwarder installed on the Sophos Enterprise Console server.

Sophos Endpoint Security application logs

The add-on collects system logs of Sophos Endpoint Security, stored in Windows event logs, using the Splunk Add-on for Windows.

There is nothing to configure in this add-on for these logs.

Sophos Endpoint Security patch logs

The add-on collects Sophos Endpoint Security patching logs using the Splunk Add-on for Windows.

To enable Sophos patch status monitoring, copy the first stanza in %SPLUNK_HOME%\etc\apps\Splunk_TA_sophos\default\inputs.conf to %SPLUNK_HOME%\etc\apps\Splunk_TA_sophos\local\inputs.conf and enable the [WinEventLog://Sophos Patch] stanza by changing disabled = 1 to disabled = 0.

Sophos Endpoint Console server logs

The add-on collects Sophos Endpoint Console server logs through monitor inputs.

Copy the all the monitor stanzas from %SPLUNK_HOME%\etc\apps\Splunk_TA_sophos\default\inputs.conf to %SPLUNK_HOME%\etc\apps\Splunk_TA_sophos\local\inputs.conf and enable the desired stanzas by changing disabled = 1 to disabled = 0. In each stanza, replace <SEC_LOG_PATH> with the path of the log files on the Sophos Enterprise Console.

Sophos Endpoint Console Syslog Logs

You can configure these logs to push via syslog over the network using Sophos Report Interface or by monitoring the SEC server log as with the server logs above. If you are monitoring the log files directly, set the source type to sophos:sec.

If you are pushing data via syslog, create an inputs.conf stanza in your syslog collector for these source types:

• sophos:utm:firewall
• sophos:utm:ips
• sophos:utm:ipsec

For example, your stanza for sophos:utm:firewall might look like this.

  [udp:23514]
  sourcetype=sophos:utm:firewall

If you are monitoring the log files directly, set the source type to sophos:sec.

Note: When collecting syslog, a best practice is to use a 3rd party aggregator (e.g. rsyslog or syslog-ng) for improved fault tolerance and scalability.