Sophos integration

If you’re new to integrations in Rewst, read through our introductory integration documentation here.

What does the Sophos integration do?

Integrating Rewst with Sophos brings robust cybersecurity capabilities to your Rewst workflows, enhancing data protection and threat management. Leverage Sophos' advanced security solutions to strengthen defense against cyber threats. Features include malware detection, ransomware protection, network security, and endpoint protection.

Why use the Sophos integration?

Account and data consistency management

Ensure consistent and standardized data across platforms by automating the setup of customer accounts.
- Automatically synchronize client names between Rewst and Sophos, eliminating the need for manual adjustments or TenantName overrides.
- Streamline the initial stand-up of customer accounts, verifying data consistency and adherence to established standards.
- Efficiently create customers, users, and other necessary entities within Sophos, ensuring a seamless onboarding process.

Alert management and security compliance

Build workflows to effectively handle alerts and ensure security compliance measures are in place.
- Enable proactive alerting when tamper protection is disabled, ensuring prompt action and maintaining security standards.

Policy and resource management

Streamline policy and resource management within Sophos, ensuring consistency and efficiency.
- Create, read, update, delete, reset, and clone policies and their settings.
- Manage endpoint groups and their members, including the ability to assign or unassign endpoints and servers.
- Assign and update policies for specific user groups, endpoints, and endpoint groups efficiently.
- Retrieve protection statuses per device, providing valuable insights into the security posture of individual assets.

Set up the Sophos integration

Sophos requires that a user be a Super Admin to manage and add API credentials.

Sophos credentials expire 36 months from the date of creation. We suggest setting a reminder to update the credential at the time of expiration.

Set up steps in Sophos

Log in to your Sophos account.
Navigate to My Products > General Settings > API Credentials Management.
Click Add Credential.
Provide a name and description for the credential to identify and distinguish it from others. We recommend Rewst API.
Choose the role that will be assigned to this credential. The available roles to choose from can be viewed here.
Click Add.
Copy the value for the Client ID and Client Secret. Save both of these somewhere secure. You'll need them for further steps in Rewst. Once you migrate away from this page, you won't be able to see the information again.

Set up steps in Rewst

Navigate to Configuration > Integrations in the left side menu of your Rewst platform.
Search for Sophos in the integrations page.
Click on the integration tile to launch the configuration setup page.
Under Parameters, enter the information copied from Sophos into the relevant fields:
1. Client ID
2. Client Secret
Click Save Configuration.
Rewst will do a quick validation of your input. Once completed, you'll see a new section beneath the configuration form for organization mapping. Complete your mapping as desired.

Got an idea for a new Integration? Rewst is constantly adding new integrations to our integrations page. Submit your idea or upvote existing ideas here in our Canny feedback collector.

Actions and endpoints

For more on how actions work in Rewst, check out our introductory actions documentation here.

Sophos' own API documentation can be found here.

The Generic API Request action does not automatically include tenant context. To avoid authentication errors, set the tenant value from your X-Tenant-ID in the request headers. You can manually add it in the headers section of the action, or pull it from the tenant dropdown in the UI.