Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integrations

About Sophos XDR integrations

This page explains the different integration types and setup methods. To get started, see Products for a list of available data ingest integrations, and Marketplace quick start for basic steps.

Sophos XDR lets you integrate other Sophos products or third-party security products with Sophos Fusion. You can set up two kinds of integrations:

  • Data ingest: The product sends data to the Sophos Data Lake. You can then query that data in Sophos XDR.
  • Response action: You can run response and enrichment tasks directly from your triage and case workflows.

Response actions aren't available for all products. For more information, see Configuring actions.

Data ingest integration setup methods

There are several types of data ingest integrations, with different setup methods:

  • API
  • Syslog via data collector
  • Sophos product, such as Sophos NDR or Sophos Firewall

The setup methods you can use depend on the product you want to integrate. For full instructions, look for the product or vendor name in Products.

API integrations

To integrate a product that uses an API, you must collect the authentication information for your account with that product.

The information you need differs from product to product. Our integration assistant prompts you for the information.

Syslog integrations

Syslog integrations use the Sophos XDR data collector to collect data from the third-party product and add it to the Sophos Data Lake.

The Sophos XDR data collector is an on-premise or cloud-based (virtual) device that Sophos XDR uses to gather logs. You then configure a supported third-party product to send data to the data collector.

For information about data collectors, including which data collectors are available, see Data collectors.

Sophos products

Select Sophos products, such as Sophos Email and Sophos Firewall, are included with your Sophos XDR subscription by default and don't require integration steps. See Sophos.

Note

Sophos NDR requires an appliance to receive data and forward it to the Sophos Data Lake. See Integration appliances.