Integrate Ordr
You must have the Network integrations license pack to use this feature.
You can integrate Ordr with Sophos Central so that it sends data to Sophos.
This integration is API-based. You'll need your base URL and an API client username and password.
The key steps are as follows:
- Create an API client in Ordr.
- Get the base URL for your Ordr service.
- Configure an integration in Sophos Central.
Create an API client in Ordr
Before you can interact with the Ordr API, you must create an API client. Creating the client generates a client username and password.
- In Ordr SCE (Systems Control Engine), in the top taskbar, click Integrations.
- Type
SCE API
into the search bar and select SCE API in the list. - The API client username and password are shown. The Authentication mode is set to Local by default.
- Copy the API client username and password. You'll need to use them later in Sophos Central.
- Click Save.
Get the base URL
The base URL combines your details with the Ordr domain, in this format:
https://your-account-name.ordr.net
Configure an integration
To integrate Ordr with Sophos Central, do as follows:
- In Sophos Central, go to Threat Analysis Center > Integrations > Marketplace.
-
Click Ordr.
The Ordr page opens. You can configure integrations here and see a list of any you've already configured.
-
In Data Ingest (Security Alerts), click Add Configuration.
Note
If this is the first integration you've added, we'll ask for details about your internal domains and IPs. See Provide your domain and IP details.
-
In Integration steps, do as follows:
- Enter a Name and Description for the integration.
-
Enter the Base URL you looked up earlier.
Make sure you prefix the URL with
https://
. For example:https://your-account-name.ordr.net
. -
Enter the API client Username and Password that you got from Ordr earlier.
-
Click Save.
We create the integration and it appears in your list. If the status icon shows Healthy, your data should appear in the Sophos Data Lake after validation.