Sophos Endpoint
Configure Sophos Endpoint integration with RAD Security for comprehensive endpoint protection.
This guide walks you through integrating Sophos Endpoint with RAD Security for comprehensive endpoint protection and threat detection, enabling you to correlate endpoint security events with container and cloud runtime activity.
Sophos Endpoint provides advanced threat protection with deep learning malware detection, exploit prevention, and active adversary mitigations.
Prerequisites
Before you begin, ensure you have:
- Access to Sophos Central Dashboard
- Super Admin privileges in Sophos Central
- Access to RAD Security workspace with integration permissions
Super Admin Required: You must have Super Admin privileges in Sophos Central to create API credentials. Lower-level admin roles cannot access the API Credentials Management section.
Step 1: Access Sophos Central Dashboard
Log in to Sophos Central
Log in to your Sophos Central Dashboard with Super Admin privileges
Navigate to Settings
Click the Settings icon (⚙️) in the top right corner
Step 2: Create API Credentials
Access API Credentials Management
Click on API Credentials Management in the settings menu
Add New Credentials
Click the Add Credentials button
Configure Credential Details
In the credential creation form, enter:
- Name: Enter a descriptive name (e.g., "RAD Security Integration")
- Description: (Optional) Add details about this integration
- Access Level: Select Service Principal Read-Only
Service Principal Read-Only access is required for the integration to function properly. This grants the read-only permissions needed to query endpoint data and security events. RAD Security only reads from Sophos; it never modifies endpoints, policies, or detections, so a read-only service principal is sufficient.
Create Credentials
Click Save or Create to generate the credentials
Copy Credentials
Immediately copy and save the following values:
- Client ID
- Client Secret
Save these values now! The Client Secret will only be displayed once. If you lose it, you'll need to create new credentials.
For detailed instructions, see Sophos API Credentials documentation.
Step 3: Determine Regional API URL
Sophos Central uses different data center regions. You need to determine the correct regional URL for your organization.
Prepare Curl Command
Use the following curl command to determine your regional URL. Replace <client_id> and <client_secret> with your actual credentials:
curl --location 'https://id.sophos.com/api/v2/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=<client_id>' \
--data-urlencode 'client_secret=<client_secret>' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=token'
Execute Command
Run the curl command in your terminal
Extract dataRegion URL
The response will include a dataRegion field. This is the URL you need for the integration configuration.
Example Response:
{
"access_token": "...",
"token_type": "bearer",
"expires_in": 3600,
"dataRegion": "https://api-us01.central.sophos.com"
}
In this example, the URL to use is: https://api-us01.central.sophos.com
Save the URL
Copy the dataRegion value - this is your regional API URL
Why determine the URL? Sophos Central has multiple data regions (US, EU, etc.), and your organization's data is hosted in a specific region. The WhoAmI query ensures you're using the correct regional endpoint for API calls.
Common Regional URLs
While you should determine your specific URL using the curl command, here are common Sophos regional endpoints:
| Region | Example URL |
|---|---|
| US 01 | https://api-us01.central.sophos.com |
| US 02 | https://api-us02.central.sophos.com |
| US 03 | https://api-us03.central.sophos.com |
| EU 01 | https://api-eu01.central.sophos.com |
| EU 02 | https://api-eu02.central.sophos.com |
Step 4: Configure in RAD Security
Navigate to your RAD Security workspace and configure the Sophos Endpoint integration with the following parameters:
Required Parameters
| Parameter | Description | Example |
|---|---|---|
| Base URL | The dataRegion URL from Step 3 | https://api-us01.central.sophos.com |
| Client ID | Client ID from Step 2 | abc123-def456-ghi789 |
| Client Secret | Client Secret from Step 2 | your-client-secret-here |
Verify Integration
After completing the setup, verify your integration is working:
- Navigate to Data Sources > Integrations > EDR in RAD Security
- Locate your Sophos Endpoint integration
- Check the connection status shows as Connected
- Verify endpoint data is being synced
Your Sophos Endpoint integration is now configured! RAD Security can now correlate endpoint security data with container and cloud runtime events.
What Data is Synced
Once configured, RAD Security will sync the following data from Sophos Endpoint:
Use Cases
Deep Learning Detection Leverage Sophos's deep learning malware detection with RAD's runtime context for enhanced threat accuracy.
Exploit Prevention Correlate Sophos exploit prevention events with container activity to detect sophisticated attacks.
Active Adversary Protection Identify active adversary techniques across endpoints and containerized workloads.
Unified Security Posture Maintain comprehensive security visibility across endpoints, containers, and cloud infrastructure.
Troubleshooting
Security Best Practices
Use Service Principals Always use Service Principal credentials rather than personal account API keys.
Rotate Credentials Regularly Periodically create new API credentials and delete old ones to maintain security.
Secure Credential Storage Store Client ID and Secret in a secure password manager or secrets vault.
Monitor API Usage Regularly review API credential usage in Sophos Central to detect anomalous activity.
Limit Access Only create the minimum number of API credentials needed for integrations.
Audit Regularly Periodically review all API credentials and remove unused or outdated ones.
Credential Management
To manage your Sophos API credentials:
View Credentials
Navigate to Settings > API Credentials Management to view all active credentials
Rotate Credentials
- Create new API credentials with a different name
- Update RAD Security with the new credentials
- Verify the integration works
- Delete the old credentials
Revoke Compromised Credentials
If credentials are compromised, immediately delete them in Sophos Central and create new ones
Additional Resources
Sophos API Documentation
Official guide to API credentials in Sophos Central
Sophos Central APIs
Complete API reference documentation