Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-sonicwall-sonicos-setup

Integrate SonicWall SonicOS

You can integrate the SonicWall SonicOS security appliance with Sophos XDR so that it sends event messages to Sophos for analysis. The integration uses a data collector, which receives third-party data and sends it to the Sophos Data Lake.

Key steps

The key steps in a SonicWall integration are as follows:

  • Install and configure a data collector if you haven't already done so.
  • Configure SonicWall to send data to the data collector.

Requirements

The following is required for SonicWall configuration:

  • Check the requirements for the data collector you are using by reviewing the guides at Data collectors.

Add a SonicWall integration

To integrate SonicWall, you must first install a Sophos XDR data collector, then configure SonicWall to send logs to it.

Install and configure a data collector

SonicWall SonicOS must be configured to send logs to the Sophos XDR data collector. Logs are filtered and correlated in real-time for various security event observations. Go to Data collectors and follow the guide for creating a data collector if you haven't already done so.

Configure logging and enable monitoring

Once the data collector is created, you can configure SonicWall to send data to us.

To set up event forwarding via syslog, do as follows:

  1. Follow the steps in SonicWall's own guide: How can I configure a syslog server on a SonicWall firewall?

  2. Be sure to configure the following data collector details:

    • IP address: The Sophos XDR data collector's server IP address
    • Port: 514

Your SonicWall SonicOS data should now appear in the Sophos Data Lake after validation.

Configuration notes

Keep the following in mind during SonicWall configuration:

  • You can configure multiple instances of SonicWall to send data to Sophos via the same data collector. After you finish integration, repeat the steps in this section for your other instances of SonicWall. You don't need to repeat the steps in Sophos XDR.
  • SonicOS 7.x might send incorrectly formatted data. If you've followed all our integration steps but still don't get SonicWall detections in Sophos XDR, try contacting SonicWall support about hotfix 46333.

Additional resources