I use the SIEM API to extract Agent usage and report back to our internal reporting systems for billing purposes.
Generally this works great, as most users within our clients have a device each and we will on per device usage.
However, Sophos bill on a per user basis, and this creates issues where we have Client who use thin clients (no agent) and logon to Terminal Servers
(1 agent/multiple users) and we have to manually check the usage for these clients - which is time consuming.
We need a way to query the API for a list all users for a client in a given period and which device they have logged on to.
As an MSP, this is a pretty basic requirement and most other large Vendors provide this functionality from the API's.
From what I can see, all I can obtain is the last user logged onto an agent. If there was an event for each user loggin on, at least I could iterate through the events for every device and get a list of users each day (painful, but at least an option).
This thread was automatically locked due to age.
