Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-linuxservers-setup

Integrate Linux servers

You can integrate Linux servers with Sophos XDR so that they send log data to Sophos for analysis. The integration uses a data collector, which receives syslog data from Linux systems and sends it to the Sophos Data Lake.

Key steps

The key steps in a Linux servers integration are as follows:

  • Install and configure a data collector if you haven't already done so.
  • Configure the Linux log sources you want to monitor, such as SSH, sudo, BIND/named DNS, and system management logs.
  • Configure syslog forwarding to send logs to the Sophos XDR data collector.

Requirements

The following is required for Linux servers configuration:

  • A Linux server configured to generate supported log types, including:

    • SSH authentication events
    • Sudo privilege-escalation events
    • BIND/named DNS events
    • System and service management events

  • Check the requirements for the data collector you're using by reviewing the guides at Data collectors.

Add a Linux servers integration

To integrate Linux servers, you must first install a Sophos XDR data collector, then configure your Linux systems to send logs to it.

Install and configure a data collector

Linux servers must be configured to send logs to the Sophos XDR data collector. Logs are filtered and correlated in real-time for various security event observations. Go to Data collectors and follow the guide for creating a data collector if you haven't already done so.

Configure logging and enable monitoring

When the data collector is ready, you can configure Linux servers to send supported log data to Sophos XDR.

Sophos XDR supports the following Linux log categories:

  • Authentication and privilege use logs, such as SSH and sudo events
  • DNS activity logs from BIND/named
  • System and service management events

To set up event forwarding via syslog, do as follows:

  1. Configure the Linux log sources you want to monitor and send them via syslog. Examples include the following:

  2. Be sure the configured IP address matches the Sophos XDR data collector's server IP address.

Your Linux servers data should now appear in the Sophos Data Lake after validation.

Configuration notes

Keep the following in mind during Linux servers configuration:

  • You can configure multiple instances of Linux servers to send data to Sophos via the same data collector. After you finish integration, repeat the steps in this section for your other instances.

Additional resources

For more information on configuring Linux servers, see the following documents: