Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-appomni-setup

Integrate AppOmni

You can integrate AppOmni with Sophos XDR so that it sends data to Sophos for analysis.

Key steps

The key steps in an AppOmni integration are as follows:

  • Get an API token and base URL from AppOmni.
  • Configure the integration in Sophos XDR.

Requirements

The following is required for AppOmni configuration:

  • An active AppOmni instance.

Add an AppOmni integration

To integrate AppOmni, you must first gather certain details from AppOmni, then provide them in Sophos XDR.

Get an API token and base URL from AppOmni

To get the AppOmni API details you need for integration, do as follows:

  1. In your AppOmni instance, go to Settings > API Settings.
  2. Click + Add Application.
  3. Give the application a name and description, then click Create new OAuth application.
  4. In the Actions column, click the three dots and select Manage Tokens.
  5. Click + OAuth Token in the upper-right corner of the page.
  6. Choose an expiry date five years from today and add a short description.
  7. Click Save.

  8. Copy the Access Token that is shown. You'll need to use it later in Sophos Fusion.

    Only the Access Token is required for Sophos Fusion. You don't need the Refresh Token.

  9. Make note of your AppOmni base URL, which consists of your organization name or AppOmni instance name followed by the AppOmni domain: https://mycompany.appomni.com.

Configure the integration in Sophos XDR

To integrate AppOmni with Sophos XDR, do as follows:

  1. In Sophos Fusion, go to Security Operations > Integrations > Marketplace.

  2. Click AppOmni.

    The AppOmni page opens. You can configure integrations here and see a list of any you've already configured.

  3. In Configured integrations, click Add new.

  4. In Add an integration, do as follows:

    1. Enter a name for the integration.
    2. Enter the Base URL and API Token (also known as the Access Token) you got from AppOmni.

  5. Click Done.

The new integration appears under Configured integrations. After provisioning is complete, a green tick indicates that the integration is working correctly and your data should appear in the Sophos Data Lake after validation.

For more information about integration statuses, see View health status of an integration.