Automated delivery of Sophos Central Active user report

Hello Patrick O'Dwyer 

You can save the Users Report as a Custom Report, and then be able to automate delivery (sent to an email address, for example), and also set to some predefined frequency.

This is available in some (not all reports). Information can be found in this KB article.

Hi,

Thanks DianneY for looking into this.

However, I'm not sure how I would automate ingestion of an email with a file attachment, or would want to have an email address setup that automatically ingests files for security reasons.

I was looking for a way to get automated retrieval of the "active user" report, either via HTTPS or using the API, but I don't see that this is achievable?

I'm sure other clients must want this sort of functionality?

Many thanks,

Patrick

Hello Patrick O'Dwyer 

Sorry about that. Please have a look at the information in this KB:

Sophos Central APIs: How to send alert and event data to your SIEM

Hi DianneY,

thanks for this. It looks like the APi can only deliver a stream of events and alerts from the past 24 hours

As far as I can see, it can not generate and deliver specific report data on demand, unless I'm missing something?

Many thanks

Patrick

Hello Patrick,

"Out-of-the-box", SIEM integration via Sophos Central APIs can send Alerts and Events data. Specific reports can be possible, but that will be something outside of what Tech Support will do, and may require Professional Services. Your Sophos partner may provide such services, and arrange to involve Sophos’ own Professional Services team if you need assistance beyond Sophos Support’s remit. Sorry for the confusion.

Hello Patrick,

"Out-of-the-box", SIEM integration via Sophos Central APIs can send Alerts and Events data. Specific reports can be possible, but that will be something outside of what Tech Support will do, and may require Professional Services. Your Sophos partner may provide such services, and arrange to involve Sophos’ own Professional Services team if you need assistance beyond Sophos Support’s remit. Sorry for the confusion.