Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-custom-integrations

Custom integrations

A Sophos Next-Gen SIEM subscription is required to integrate using custom transport methods. See Sophos Next-Gen SIEM overview.

Sophos XDR supports several methods to ingest data in a data source-agnostic way. This allows our NG-SIEM subscribers to build custom integrations with the platform for data sources that are not currently optimized by Sophos.

Note

With custom integrations, only the transport of data from a data source into Sophos XDR is guaranteed. Downstream outcomes such as normalization, search, and generating detections have not been tested and may require additional work beyond ingest to be achieved.

If the data source you wish to integrate with Sophos XDR has not yet been optimized by Sophos, or you wish to explore additional options for integration, there are several available custom transport methods you can use.

  • HTTP Ingest

    Send logs directly to Sophos Fusion through authenticated HTTP requests, without deploying cloud infrastructure.

    Choose this option if your data source supports posting events to a webhook or HTTP endpoint using bearer-token authentication.

    HTTP Ingest

  • Customer-Managed S3

    Connect an AWS S3 bucket in your own AWS account using a Lambda function that forwards logs to Sophos Fusion.

    Choose this option if your data source writes events to an S3 bucket that you control.

    S3 Ingest - Customer-managed

  • S3 Ingest (Sophos-Managed, with token)

    Send logs directly to a Sophos-managed S3 destination without deploying your own AWS infrastructure.

    Choose this option if your vendor requires an ownership challenge token to verify bucket ownership.

    S3 Ingest - Sophos-Managed (with token)

  • S3 Ingest (Sophos-Managed, without token)

    Send logs directly to a Sophos-managed S3 destination without deploying your own AWS infrastructure.

    Choose this option if your vendor does not require an ownership challenge token.

    S3 Ingest - Sophos-Managed (without token)

  • Azure Event Hubs

    Stream logs from an Azure Event Hubs namespace directly to Sophos Fusion with no additional cloud infrastructure.

    Choose this option if your data source publishes events to Azure Event Hubs.

    Microsoft Azure Event Hubs

  • Azure Storage Account

    Connect an Azure Storage Account in your Azure subscription using an Azure Function that forwards logs to Sophos Fusion.

    Choose this option if your data source writes events to a storage account that you manage.

    Microsoft Azure Storage Account