Getting started: exporting alerts

Sophos Linux Sensor (SLS) is designed to make it easy for users to output SLS Alert data in a way that fits naturally with their existing workflows. SLS provides multiple options to export alerts. This isn't limited to a single alert output configuration. You can use multiple external data sources as a destination point for SLS alerts. For example, sending alerts to Splunk and Slack, or stdout and Sophos Central.

Getting Alerts via a file

The file output type writes alerts to a file on SLS's local file system. This output type is commonly used to integrate with existing log shippers that can read from a log file.

Configuration:

Key	Required	Description
type	yes	The output type.
enabled	yes	Turns the output on or off.
name	yes	The file name.
max_size	no	The max file size in MB that a log file can be before it's rotated. Defaults to 100.
max_backups	no	The max number of log files to retain. Defaults to not deleting any old log files.

Here's an example of SLS writing to two local files:

alert_output:
  outputs:    # Write the full Alert to a local log file
    - type: file
      enabled: true
      name: /var/log/sophos-alerts.json

    # Write a truncated Alert summary to a different local log file 
    - type: file      
      enabled: true    
      template: "{{.UUID}} {{.StrategyName}} {{.ProcessInfo.Tgid}} {{.ProcessInfo.Program.Path}}"
      name: /var/log/sophos-alert-summaries.json

Getting Alerts via stdout

The stdout output type prints alerts to the SLS's standard output. This output type is commonly used to quickly test new policy settings in development as well as to easily integrate with existing log shippers in containerized environments.

Note

Alerts will be mixed in with anything else printed to stdout by SLS such as initialization information or logged errors.

Configuration:

Key	Required	Description
type	yes	The output type.
enabled	yes	Turns the output on or off.

Here's an example of printing Alerts to stdout:

alert_output:
  outputs:
    - type: stdout
      enabled: true

Getting Alerts via syslog

The syslog output type sends alerts to a syslog server.

Key	Required	Description
type	yes	The output type.
enabled	yes	Turns the output on or off.
url	yes	The syslog server URL (local or remote).

Here's an example of sending Alerts to a local syslog server:

alert_output:
  outputs: # This could also be a remote syslog server
    - type: syslog
      enabled: true
      url: tcp://127.0.0.1:514/sophos_alerts

You can also configure this via an environment variable

RUNTIMEDETECTIONS_ALERT_SYSLOG_URL=tcp://syslog-server:514/sophos_alerts

Getting Alerts via a webhook

The webhook output type sends alerts to a webhook endpoint with an HTTP request. This output type is incredibly powerful when combined with Alert Templates because it allows users to create ad hoc integrations with a number of third-party services. Some common use cases are to ship Alert summaries to Slack, automatically create Jira tickets when high priority Alerts are seen, or even to send Alerts directly to a Splunk Cloud instance.

Here's an example:

alert_output:
  outputs:
    # Send Alerts to a local web server
    - type: webhook
      enabled: true
      url: http://localhost:8080/alerts

    # Send Alerts to an arbitrary service with all settings
    - type: webhook
      enabled: true
      url: https://api.example-company.com/sophos_alerts
      template: "New Sophos Alert {{.UUID}}"
      timeout: 5
      method: PUT
      headers:
        "Content-Type": "text/plain"
        "X-COMPANY-AUTH": "123456"

    # Send Alerts to Slack using their webhook JSON format
    - type: webhook
      enabled: true
      url: https://hooks.slack.com/services/123ABC/ab914B12eeigVh2xZ
      template: '{"text": "New Sophos Alert {{.PolicyType}} {{.Description}}"}'