Understanding Sophos Next-Gen SIEM and planning retention
Next-Gen SIEM adds longer data retention and custom integrations to XDR and MDR. A source inventory and a documented pilot help establish whether its …
Sophos SIEM
Sophos Next-Gen SIEM adds longer retention and custom data sources to XDR and MDR. These guides lead from planning through collectors and transport to normalisation and verifiable search.
SIEM workflows
From the source inventory to a verified event
Clarify licensing and data requirements first. Then set up the appropriate data path and accept transport, field mapping and the intended analysis separately. XDR/SIEM guides remain available in their existing product categories too.
Planning, licensing and retention 1
Assess the additional value over XDR and MDR. Record data volumes, search windows, retention and operational ownership before connecting a source.
Windows, network and cloud telemetry 3
Ingest sources shared by XDR and SIEM using the correct format and collector. SIEM entitlement depends on the event type.
Send Windows Event Logs to Sophos XDR and SIEM
Connect Windows Event Log through a supported forwarder and verify ingestion; distinguish process command-line requirements from netflow licensing.
Ingest network telemetry through a Sophos XDR collector
Four practical syslog paths covering formats, prerequisites, timestamps, acceptance and controlled removal.
Connect cloud flow logs to Sophos XDR and SIEM
Four practical cloud data paths covering setup, permissions, formats and acceptance. Check the SIEM licensing requirement for each telemetry schema.
Transport custom sources 3
Choose HTTP Ingest, one of the three S3 variants, or Azure Event Hubs and Storage to match the existing source path, then verify each separately.
Sophos SIEM: choose a custom transport and set up HTTP Ingest
HTTP Ingest connects a POST-capable log source to Sophos Fusion. Transport selection, secret storage and testing distinguish delivery from usable …
Sophos SIEM: connect customer-managed and Sophos-managed S3
Three S3 transports differ in ownership, permissions and ownership verification. This guide separates their setup and event acceptance procedures.
Sophos SIEM: connect Azure Event Hubs and Blob logs
Event Hubs and Blob Storage use different integrations. This guide explains prerequisites, exact parameters, operation and limits for both methods.
Parsers, search and practical acceptance 2
Prepare Custom Parsers with suitable schemas and check raw messages, normalisation and search. A practical lab example connects these steps.
Create, test and operate Sophos SIEM custom parsers
Working log transport does not yet provide useful normalization. This runbook takes you from source samples and schema selection to testing and …
Sophos SIEM: verify HTTP Ingest and a parser with an example
A small custom JSON source makes transport, timestamps, result mapping and search separately verifiable. With safe secret handling, negative checks …
Choose the right starting point
A new SIEM pilot starts with product and retention planning. Record which source should supply each event and who will act on it. The categories below arrange existing guides around this workflow; they change neither licence requirements nor existing article URLs.
Collectors and custom transport serve different purposes. For supported syslog sources, migration to the XDR Data Collector explains the ingestion path. A custom application capable of POST requests might instead use HTTP Ingest. A green transport status never confirms correct field mapping or a detection by itself.
The end-to-end HTTP/parser practical example describes a synthetic test source, Auth mapping, a search query and cleanup. For real data, the source format, parser and acceptance criteria must be confirmed in an approved pilot.
For further analysis, the Data Lake Search guide covers search and fields. Automatic detection and custom rules remain a separate task; the Custom Rules overview explains their boundaries. An ordinary test login need not trigger an alert.