Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-ng-siem-overview

Sophos Next-Gen SIEM overview

Sophos Next-Gen SIEM is a compliance-focused extension for Sophos XDR Powered by Secureworks and Sophos MDR. It adds the following capabilities to the same platform used for threat detection and response without requiring a separate SIEM platform:

  • Long-term data retention
  • Expanded data ingestion
  • Compliance reports and dashboards

Sophos Next-Gen SIEM is designed for organizations that must meet regulatory, governance, or audit requirements. Sophos XDR remains the primary platform for threat detection, investigation, response, automation, and security operations. Sophos Next-Gen SIEM complements Sophos XDR with compliance-focused capabilities. These include long-term retention, audit readiness, policy monitoring, and preservation of historical data required for reporting and regulatory obligations.

License requirements

Sophos Next-Gen SIEM is an add-on for Sophos XDR Powered by Secureworks and Sophos MDR. You can't purchase Sophos Next-Gen SIEM as a standalone product.

The number of Sophos Next-Gen SIEM subscriptions must match the total number of licensed Sophos XDR and Sophos MDR users and servers.

See Sophos Licensing Guidelines.

Data collector recommendations

If you use a legacy Sophos log collector for syslog integrations, we highly recommend that you migrate it to a Sophos XDR data collector. Legacy log collectors don't support the full data retention capabilities of Sophos Next-Gen SIEM, while Sophos XDR data collectors do.

You don't need to reconfigure existing API integrations.

To migrate a legacy log collector, see Migrating from log collectors to XDR data collectors.

Expanded data ingestion and custom parsing

Sophos Next-Gen SIEM expands data ingestion support to include the ability to build custom integrations with the platform for data sources that Sophos doesn't currently optimize. See Custom integrations.

You can then configure custom parsers to normalize logs from those data sources into Sophos XDR's standardized event schemas. This lets detectors, custom detection rules, and advanced search operate on the data. See Custom parsers overview.

Compliance reporting

The NG-SIEM dashboard has widgets for access control, network security, and audit events. To see the dashboard, go to Dashboards > Manage dashboards and click Find dashboards to add it to your list.

For details on dashboards, see Dashboards.

Data retention

Sophos Next-Gen SIEM includes 13 months of data retention by default.

Organizations that require longer retention periods can purchase add-ons that extend data retention to three, five, seven, or 10 years.

These retention options help you align data retention policies with industry regulations and internal governance requirements.