Sophos Firewall

Sophos Firewall integrates with Sophos Central so that it can send alerts to Sophos MDR and XDR for analysis.

You must have a Sophos Firewall license to use this integration.

Sophos firewalls managed by Sophos Central are automatically integrated. You only need to make sure that they use Sophos Central reporting. See Turn on firewall reporting.

By default, the Sophos Firewall integration is turned on.

A single integration applies to all your managed Sophos firewalls. You can't choose to integrate some firewalls but not others.

This page tells you how to manage and monitor your integration.

Check the integration is turned on

To check that your integration is turned on, do as follows:

In Sophos Central, go to Threat Analysis Center > Integrations > Marketplace.
Search for "Sophos Firewall".

The Sophos Firewall card shows the integration status. If the integration is turned on, you see "1 Online" and the license expiration date.

Turn integration on or off

To turn Sophos Firewall integration on or off, do as follows:

In Sophos Central, go to Threat Analysis Center > Integrations > Marketplace.
Search for "Firewall".
Click the Sophos Firewall card.
On the Sophos Firewall page, under Integration details, use the Enable/Disable Integration toggle to turn the integration on or off.
Click Save.

The Marketplace page opens. If the integration is turned on, the Sophos Firewall card shows "1 Online" and the license expiration date.

View integration activity

To view integration activity, do as follows:

Go to Threat Analysis Center > Integrations > Configured.
Find Sophos Firewall.
In the Configuration Type column, click Data Ingest.

A new pane slides out from the right of the screen, showing details of data collection and processing.