AppOmni
You can integrate AppOmni with Sophos XDR so that it sends data to Sophos for analysis.
This page gives you an overview of the integration.
AppOmni product overview
AppOmni is a SaaS security platform that provides visibility, risk detection, and access control for cloud applications. It helps organizations prevent data exposure, enforce security policies, and monitor threats across their SaaS environments.
What we ingest
Sophos XDR collects AppOmni data over HTTPS by polling the AppOmni detection alerts API. The following log categories are collected:
- Detection alerts: AppOmni threat and policy detection alerts across your monitored SaaS applications.
Event and data types
All AppOmni events are normalized uniformly to third-party security alert telemetry. They include:
- Detection alerts: AppOmni detection alerts such as mass download actions, suspicious location and session activity, group policy object deletions, and mail transport rule changes, including the rule name, threat, and MITRE ATT&CK mapping.
Data provided by this integration
Data provided by AppOmni gets normalized to the following schemas:
thirdpartyalert
For more information about using schemas in Data Lake Search, see Schemas and logical types.