Sophos Firewall Configuration On-Premises

This article covers how to configure Sophos firewall to forward events. 

Configuring Sophos Firewall to forward events

Take the following steps to configure your Sophos Firewall:

Procedure:

1. Go to System services > Log settings and click Add.
2. Specify the settings.

• • Name: give a name to the device as “Sophos_firewall @ device_ip”
  • IP: Give <Google Chronicle Forwarder IP>
  • Secure Log Transmission: “Enable” the check box
  • Port: Select port “11682”
  • Facility: Select “Local 6”
  • Severity Level: Select “Informational”
  • Format: select “Device Standard Format”

3. Click Save

4. Repeat the process for each device that needs to be onboarded to chronicle.

5. Once the configuration is completed, need to validate the logs in chronicle using a regular expression as (".*") this expression, or with a specific hostname, will provide the log source types which are ingesting to chronicle, below is the screenshot for reference. 

Reference:

https://www.manageengine.com/products/firewall/help/configure-sophos-xg-firewalls.html

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/SystemServices/LogSettings/SyslogServerAdd/index.html