Reports Top10 Alerts & Locations [URGENT]

Hi,

I see three options for getting and presenting this data:

1. Export the data as seen in the UI to csv. Import into Excel and create a pivot table where Event is the Row and Count of the Event is the Value. Clearly this is manual and would need to be done at least every 3 months so keep all data.

2. Use the new SIEM interface to pull the data.
https://community.sophos.com/kb/en-us/125339

3. Call the current UI APIs to get the data from a script.  This would be unsupported but may offer something.

Both 2 and 3 could be scheduled and consumed by something like Splunk which has Dashboards setup.  

There was talk of a scheduled report being emailed to the admins.  That might be enough but I'm not sure where that went.

Regards,

Jak

Dear Jak:

Thank you very much for your response, as distributors we are doing step 1, but that is not a job that the Final Customer should be doing. They need to make reports on the times that they think are convenient [of course within the 90 days that Sophos saves the data].

Another problem is that if there are more than 1000 alerts simply can not be exported in .CSV and must be done every 15 days, every 20 or depending on what Sophos Central supports.

QUESTION: How can this happen, if there are more than a thousand alerts, you have to get the reports out?

Believe it or not, this does not leave a good impression on the end customers.

=========================

Estimado Jak:

Muchas gracias por su respuesta, como distribuidores venimos haciendo el paso 1, pero eso no es un trabajo que deba estar haciendo el Cliente Final. Ellos lo que necesitan es hacer reportes en los tiempos que ellos crean convenientes [claro está dentro de los 90 días que Sophos guarda la data].

Otro de los problemas que se viene presentando es que si hay más de 1000 alertas simplemente no se puede exportar en .CSV y hay que hacerlo cada 15 días, cada 20 o dependiendo de lo que Sophos Central soporta.

PREGUNTA: Cómo es posible que suceda eso, que si hay más de mil alertas se tenga que sacar por partes los reportes?

Créase o no, esto no deja buena impresión hacia los clientes finales.

Hi,

This kind of report is still not available !!

Can someone from Sophos please confirm..

Hi Everyone,

As of now, the requested reports are not available under the predefined set of conditions in Sophos Central. However, you can get the statics report by any of the above method that was already suggested. 

If you can wish to have more reports on statics for Audit, I would request you to vote this feature request.