Analyze and retain Sophos Central Audit Logs

Sophos Central records administrative activity in the Audit Log. After a false positive, policy change, or suspicious sign-in, it shows which account performed the action, at what time, and from which IP address.

The Audit Log is not a complete SIEM. The portal can look back no more than 90 days. Organizations with longer evidence-retention requirements or a need to correlate quickly with Entra, firewall, and endpoint logs must export or ingest the data regularly.

Do not confuse Audit Log and Event Log

Blocked malware appears as an event or alert. Closing that alert later, adding a global exclusion, or changing a role is instead an administrative activity in the Audit Log.

An audit entry may, for example, report that Users and Groups were changed, identify the newly created user as the specific object, or record a successful Central account authentication. The combination of object type, modified object, description, and acting account is more informative than any one field alone.

Access and roles

The current path is Reports > General logs > Audit Logs. Visible data depends on the administrator role. A Custom Role must permit Access sensitive logs & reports.

Audit access should not be granted indiscriminately to every help-desk account. Entries contain administrator names, IP addresses, and security-relevant changes. At the same time, at least one operational role needs access so incidents can be investigated without relying exclusively on a Super Admin account.

Read the fields correctly

Each entry typically contains:

• Date for date and time,
• Modified by for the acting Central account,
• Item type for the affected object class,
• Item modified for the specific object,
• Description for additional details,
• IP address for the source address of the action.

Modified by provides little accountability when accounts are shared. This is one reason every person requires a separate administrator account. API actions remain traceable to their machine identity when each integration uses its own credential.

Investigate in the correct order

For a suspicious change, first narrow the relevant time range. Central shows the last seven days by default, and the portal range can be extended to at most 90 days. Select Update after changing the date or search term.

Search is deliberately limited and is particularly useful for:

• the IP address from which a change was made,
• the value in Modified by,
• a combination of search term and selected time range.

Then examine related changes as a sequence. A global exclusion may follow a sign-in, role change, policy adjustment, and alert closure. A single entry does not explain that context.

Use exports correctly

Central offers CSV and PDF. There is an important difference:

• current view includes the selected view and its filters,
• past 90 days exports the full 90-day period; a search filter may apply, but the portal’s selected date range does not.

Start the export from Export on the right of the Audit Logs page. Deliberately select the current view or 90-day export and the required format. Before clicking, reread the search term and view so a filtered file is not mistakenly stored as the complete audit record.

Immediately assign an unambiguous filename after export, for example including the tenant, time range, and creation date. Do not place generic names such as audit.csv unchanged in a shared folder.

CSV is suitable for filtering, correlation, and automated processing. PDF is useful when an unchanged snapshot is required for a ticket or approval. For evidence preservation, also record a hash of the exported file and store the original read-only.

Operational retention

A monthly export is a practical minimum when no SIEM is connected. Overlap the export period with the previous run so a failed job or delayed month-end process does not create a gap. Duplicate entries can be removed later; missing entries cannot be reconstructed.

Larger environments should use the Sophos Central API. Give the machine identity only the required role, monitor it, and rotate it.

A useful retention rule defines:

• the responsible team and storage location,
• retention duration according to internal and legal requirements,
• access protection and immutability,
• time synchronization,
• search and restore testing,
• the procedure for a failed export.

Important control cases

Do not wait for an incident before opening the Audit Log. Regular samples should specifically review:

• added or removed administrators,
• assignment of Super Admin and Custom Roles,
• creation and deletion of API credentials,
• changes to MFA, federated sign-in, and directory sources,
• global exclusions, Tamper Protection, and policy changes,
• automatic changes by Account Health Check,
• device or tenant migrations,
• activation of Remote Assistance.

After Fix automatically in Account Health Check, verify the changes in the Audit Log. A green score alone does not prove that the change is suitable for the operating environment.

Common problems

Expected change is missing

First check the time range, time zone, search filter, and Update. Then determine whether the action really occurred in this tenant or originated from an Enterprise, partner, or other customer context.

Export contains more data than the view

For past 90 days, the date range selected in the portal does not apply as it does for current view. For tightly scoped evidence, export the current view and then verify its contents.

Administrator name is ambiguous

Eliminate shared accounts. Use a separate API credential per application for machine access. For federated sign-in, also correlate the IdP sign-in logs.

Audit access is missing

For a Custom Role, verify that access to sensitive logs and reports is enabled. If the option is absent entirely, a Super Admin must review the role assignment.

Frequently asked questions