Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-clarotycontinuousthreatdetection-setup

Integrate Claroty CTD

You can integrate Claroty Continuous Threat Detection (CTD) with Sophos XDR so that it sends data to Sophos for analysis. The integration uses a data collector, which receives third-party data and sends it to the Sophos Data Lake.

Key steps

The key steps in a Claroty CTD integration are as follows:

  • Install and configure a data collector if you haven't already done so.
  • Configure Claroty CTD to send data to the data collector.

Requirements

The following is required for Claroty CTD configuration:

  • Check the requirements for the data collector you're using by reviewing the guides at Data collectors.

Add a Claroty CTD integration

To integrate Claroty CTD, you must first install a Sophos XDR data collector, then configure Claroty to send logs to it.

Install and configure a data collector

Claroty CTD must be configured to send logs to the Sophos XDR data collector. Logs are filtered and correlated in real-time for various security event observations. Go to Data collectors and follow the guide for creating a data collector if you haven't already done so.

Configure logging and enable monitoring

When the data collector is ready, you can configure Claroty CTD to send us data.

To set up event forwarding via syslog, do as follows:

  1. Follow the steps in the Claroty CTD administration guide.

  2. Be sure to configure the following data collector details:

    • MESSAGE CONTENT: Select Alerts (all Alert Categories and Types).
    • FORMAT: Select CEF.

    • SEND FROM (when sending from the EMC): Select applicable CTD Servers.

      Note

      Logs can be sent from individual CTD Servers or the Enterprise Management Console (EMC).

    • SEND TO: Select External Syslog server.

    • VENDOR: Select Other.
    • SYSLOG SERVER IP Enter the Sophos XDR data collector's server IP address.
    • PORT: Enter 601.
    • PROTOCOL: Choose TCP.

    Claroty CTD syslog configuration.

Your Claroty CTD data should now appear in the Sophos Data Lake after validation.

Configuration notes

Keep the following in mind during Claroty CTD configuration:

  • Logs can be sent from individual CTD Servers or the Enterprise Management Console (EMC).
  • You can configure multiple instances of Claroty to send data to Sophos via the same data collector. After you finish integration, repeat the steps in this section for your other instances of Claroty.

Additional resources

For more information on configuring Claroty CTD, see the following documents: