Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-ciscoiosandnxos

Cisco IOS and NX-OS

You can integrate Cisco IOS and NX-OS with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

Cisco IOS and NX-OS product overview

Cisco IOS and NX-OS are Cisco's network operating systems that run its routing and switching hardware (IOS across Cisco's enterprise routers and switches, and NX-OS on the Nexus data-center switch family), providing routing, switching, network management, and security services.

What we ingest

Sophos XDR collects Cisco IOS and NX-OS data by listening for syslog messages your routers and switches forward to a Sophos XDR data collector. The following log categories are collected:

  • Authentication: Device login events (successful and failed administrative logins).
  • Configuration and management: Device configuration, system, and module event messages.

Event and data types

We ingest the following event and data types from Cisco IOS and NX-OS:

  • Authentication: Device login events, including successful and failed administrative logins, with the user, source, and result. Normalized to authentication telemetry.
  • Configuration and management: Device configuration changes and system and module-level event messages, including debug and trap messages. Normalized to management event telemetry.

Data provided by this integration

Data provided by Cisco IOS and NX-OS gets normalized to the following schemas:

  • auth
  • managementevent

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation