CCX Unified Add-On for Sophos Central

About Us: CyberCX is Australia’s greatest force of cyber security experts. Our highly skilled professional services team operates a 24x7 on-shore security operations centre (SOC) servicing corporate and public sector organisations across Australia and New Zealand, specialising in Security Operations services leveraging Splunk. Description: The CCX Unified Splunk Add-on for Sophos Central looks to provide a single field extraction bundle for Sophos Central logs. This TA was built using a large dataset and endeavours to be the most CIM compliant comprehensive field extraction TA available for Sophos Central ingested logs via Sophos connector script on Splunk Heavy Forwarders or via Splunk Add-on Sophos Central API. Below are some of the listed products supported: - Sophos Central (payload JSON) - Sophos Central API: Alerts, Events, Tenants, and Endpoints Fully compatible with Splunk Enterprise and Splunk Cloud, built by an Ops team for Ops teams. Features: - This TA currently supports logtypes tagged under the following CIM datamodels: Alerts, Web, Change, Malware, Intrusion Detection (IDS), Data Loss Prevention (DLP), Inventory, Endpoint.