Sophos Central

Sophos Central is a unified console that provides one place to manage Sophos products, including endpoint, mobile, encryption, web, email, server, and wireless security.

Creating a Client ID for Sophos Central

Before configuring the Sophos Central connector in Lucidum, you must first create an API Key. Lucidum will use the API key to access the Sophos Central API.

To create Sophos API credentials, do the following:

1. Log in to Sophos Central Admin.

2. Click Add Credential and give the credential details.
   This generates the credential, together with a Client ID and a Client Secret.

3. Copy the Client ID and Client Secret.

Configuring the Connector for Sophos Central

To configure Lucidum to ingest data from Sophos Central:

1. Log in to Lucidum.

2. In the left pane, click Connector.

3. In the Connector page, click Add Connector.

4. Scroll until you find the Connector you want to configure. Click Connect. The Settings page appears.

5. In the Settings page, enter the following:

   •  URL (required): Sophos API URL, for example, https://api-***.central.sophos.com

   • Client ID (required): Client ID

   • Client Secret (required): Client secret

   • Verify SSL. For future use.

6. To test the configuration, click Test.

   • If the connector is configured correctly, Lucidum displays a list of services that are accessible with the connector.

   • If the connector is not configured correctly, Lucidum displays an error message.

Supported Actions

• Isolate an endpoint

• Scan an endpoint

• Delete an endpoint