Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-broadcomvmwarevcenter

Broadcom (VMware) vCenter

You can integrate vCenter with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

vCenter product overview

Broadcom (VMware) vCenter Server is centralized management software for VMware vSphere environments, providing unified visibility and control over ESXi hosts and virtual machines across the datacenter and hybrid cloud from a single console.

What we ingest

Sophos XDR collects VMware vCenter data by listening for syslog messages your vCenter Server forwards to a Sophos XDR data collector. The following log categories are collected:

  • Authentication: vCenter user login and logout events.
  • Configuration and management: vCenter management operations and command execution.

Event and data types

We ingest the following event and data types from vCenter:

  • Authentication: vCenter user login and logout events, with the user, source, and result. Normalized to authentication telemetry.
  • Configuration and management: vCenter management operations and command execution, including administrative actions on the vSphere environment. Normalized to management event telemetry.

Data provided by this integration

Data provided by vCenter gets normalized to the following schemas:

  • auth
  • managementevent

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation