sophos/Sophos-Central-SIEM-Integration

Sophos Partner API Integration

UMB-Linus opened this issue · 2 comments

Hi everyone,

Has anyone thought about adapting this script for the Sophos Partner API?
https://developer.sophos.com/docs/partner-account-enum/1/overview

Because we would definitely be interested :)
Or I'll build something myself.

Regards,

Linus

Partner API seems to be more to do with getting/updating data on your clients and their billing type; I don't see API endpoints that would allow you to poll for event API's in a multi-tenancy style way.. assuming that's what you're after?

With the latest release (2.0.1) you can now use partner/organization level API credentials in the config.ini file. You have to specify which tenant you want to pull events/alerts for using the "tenant_id" config parameter. In the future, we plan to support aggregating this data across tenants managed by a partner or tenants that are part of an organization.