Get ARP Table via API

As far as i know, this is currently not possible via XML API.

The cache is not filled with the proper information to curl this from the XML API. 

But you can do this via Central, if you are a Central customer. 

The datalake stores this kind of information and you can cross relate this to information coming from the endpoint to discover unwanted clients in the ntework etc.

See: https://community.sophos.com/intercept-x-endpoint/edr-data-lake-eap/

https://community.sophos.com/intercept-x-endpoint/edr-data-lake-eap/b/announcements/posts/xg-firewall-data

Hi Lucar,

thanks, I see. I connected a XG Cluster with Sophos Central, turned on reporting and signed on the data lake EAPs.

I can request logdata in data lake, it seems that queries "Network: ARP cache" do not return any data. The xdr_data table seems to be empty and I assume that it is the table for endpoint data. I do not have any endpoints installed. Is there a document for the database schema of the xgfw_data table available or is it only the logs as of now? I seems the data lake for XG is still work in progress.

Cheers

Hi Lucar,

thanks, I see. I connected a XG Cluster with Sophos Central, turned on reporting and signed on the data lake EAPs.

I can request logdata in data lake, it seems that queries "Network: ARP cache" do not return any data. The xdr_data table seems to be empty and I assume that it is the table for endpoint data. I do not have any endpoints installed. Is there a document for the database schema of the xgfw_data table available or is it only the logs as of now? I seems the data lake for XG is still work in progress.

Cheers

You assumption is correct, xdr_data is related to endpoint data. All firewall data is stored in the xgfw_data table, see:  https://community.sophos.com/intercept-x-endpoint/edr-data-lake-eap/b/announcements/posts/xg-firewall-data .  

You can most likely use the data logged by the firewall rule logging to generate something that comes pretty close to the ARP table. The query below should be a good starting point:

SELECT DISTINCT src_ip, src_mac, in_interface
FROM xgfw_data
WHERE log_component = 'Firewall Rule'
AND timestamp > timestamp '2021-03-23 14:00:00.000'

Thanks Marcel, I will turn on logging for additional rules and can hopefully catch most devices. For layer 2 discovery the endpoint ARP cache would be more interesting.