Skip to content

174 sophos add note for shorter message #229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
StefanAustin wants to merge 6 commits into
base: 7.0
Choose a base branch
from
Open

174 sophos add note for shorter message #229

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
075aa0e
Update Sophos Central Content Pack.htm
StefanAustin Jun 18, 2025
a4e30b7
minor formatting
annie-zempel Jun 26, 2025
25a4c1e
Update SFOS 19.5 Content Pack.htm
StefanAustin Oct 13, 2025
a0d253b
Update SFOS 19.5 Content Pack.htm
StefanAustin Oct 13, 2025
8851290
Update Sophos Central Content Pack.htm
StefanAustin Oct 13, 2025
258f499
Merge branch '7.0' into 174-sophos-add-note-for-shorter-message
StefanAustin Oct 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions Content/Content Packs/SFOS 19.5 Content Pack.htm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,9 @@ <h2>Sophos XG/XGS Firewall Message Processing</h2>
<li>
<p>Extraction of fields, normalization, and enrichment of SFOS log messages.</p>
</li>
<li>The message field will be replaced by a shorter message to reduce license utilization. Activate the <code class="linecode">full_message</code> option in the input if needed.</li>
<section class="infoBox">
<div class="content"><b>Hint:</b> This pack rewrites the message field to reduce license utilization. To get the full message, set <i>Store full message</i> in the input settings to true.</div>
Copy link
Contributor

@gormanbj gormanbj Oct 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should there be a space after >?

  • </b> This pack...

I don't have a system w/ the input running but verify store full message is actually a true or false setting. Update wording if necessary.

Copy link
Author

@StefanAustin StefanAustin Oct 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I copied it from an existing pack 1 by 1.... to have a consistent structure. I can of course mixes styles ... .
In terms of input, I do not have that input running either and the configuration is is step two behind the API connection test.
@CG3827 do you still have the input running?

</section>
</ul>
<ul>
<li>
Expand Down Expand Up @@ -242,4 +244,4 @@ <h2>Sophos XG/XGS Firewall Message Processing</h2>
</tbody>
</table>
</body>
</html>
</html>
11 changes: 6 additions & 5 deletions Content/Content Packs/Sophos Central Content Pack.htm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,7 @@
<MadCap:snippetBlock src="../Resources/Snippets/IlluminateBanner.flsnp" />
<p>Sophos Central is a cloud-based unified security management platform that delivers centralized administration, threat detection, and policy enforcement across a range of security services encompassing network, endpoint, server, mobile, and email security. This content pack extracts fields from Sophos Central Endpoint Protection telemetry and event messages and normalizes them to align with the Graylog schema.</p>
<h2>Supported Version(s)</h2>
<ul>
<li>
<p>Sophos Central is a continuously updated managed service that does not feature version numbers. This pack was built and tested for integration with the Sophos Central SIEM Integration v1 API. In addition, parsing is designed around Sophos Central events sourced from Windows endpoints. Events from other OS platforms such as macOS may be supported, but not fully tested.</p>
</li>
</ul>
<p>Sophos Central is a continuously updated managed service that does not feature version numbers. This pack was built and tested for integration with the Sophos Central SIEM Integration v1 API. In addition, parsing is designed around Sophos Central events sourced from Windows endpoints. Events from other OS platforms such as macOS may be supported, but not fully tested.</p>
<h2>Requirements</h2>
<ul>
<li>
Expand Down Expand Up @@ -90,6 +86,11 @@ <h3>Configuring a Sophos Central Input</h3>
</li>
</ol>
<p>If the input does not start automatically, select <i>Start Input</i> to begin retrieving and processing messages from the configured Sophos Central server.</p>
<p>
<section class="infoBox">
<div class="content"><b>Hint:</b> This pack rewrites the message field to reduce license utilization. To get the full message, set <i>Store full message</i> in the input settings to true.</div>
Copy link
Contributor

@gormanbj gormanbj Oct 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same (see previous comment).

</section>
</p>
<h2>Log Format Example</h2>
<MadCap:codeSnippet>
<MadCap:codeSnippetCopyButton />
Expand Down