Skip to content
Find out how we support MDR.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=ordr

Integrate Ordr

API Network

You must have the Network integrations license pack to use this feature.

You can integrate Ordr with Sophos Central so that it sends data to Sophos.

This integration is API-based. You'll need your base URL and an API client username and password.

The key steps are as follows:

  • Create an API client in Ordr.
  • Get the base URL for your Ordr service.
  • Configure an integration in Sophos Central.

Create an API client in Ordr

Before you can interact with the Ordr API, you must create an API client. Creating the client generates a client username and password.

  1. In Ordr SCE (Systems Control Engine), in the top taskbar, click Integrations.
  2. Type SCE API into the search bar and select SCE API in the list.
  3. The API client username and password are shown. The Authentication mode is set to Local by default.
  4. Copy the API client username and password. You'll need to use them later in Sophos Central.
  5. Click Save.

Get the base URL

The base URL combines your details with the Ordr domain, in this format:

https://your-account-name.ordr.net

Configure an integration

To integrate Ordr with Sophos Central, do as follows:

  1. In Sophos Central, go to Threat Analysis Center > Integrations > Marketplace.

  2. Click Ordr.

    The Ordr page opens. You can configure integrations here and see a list of any you've already configured.

  3. In Data Ingest (Security Alerts), click Add Configuration.

    Note

    If this is the first integration you've added, we'll ask for details about your internal domains and IPs. See Provide your domain and IP details.

  4. In Integration steps, do as follows:

    1. Enter a Name and Description for the integration.

    2. Enter the Base URL you looked up earlier.

      Make sure you prefix the URL with https://. For example: https://your-account-name.ordr.net.

    3. Enter the API client Username and Password that you got from Ordr earlier.

  5. Click Save.

We create the integration and it appears in your list. If the status icon shows Healthy, your data should appear in the Sophos Data Lake after validation.