This document explains how to configure the Sophos integration with the Cloud Threat Exchange module of the Netskope Cloud Exchange platform. This plugin fetches the SHA256 type of threat indicator from Threat Graphs under Threat Analysis Center in the Sophos platform. This plugin does not support sharing of indicators to the Sophos platform.
Prerequisites
To complete this configuration, you need:
- A Netskope tenant (or multiple, for example, production and development/test instances).
- A Threat Prevention subscription for malicious file hash sharing.
- A Netskope Cloud Exchange tenant with the Tenant plugin and Threat Exchange plugin already configured.
- A Sophos instance.
- A Service Principal ReadOnly user that can fetch the events using SIEM API.
Sophos Plugin Support
| Fetched indicator types | SHA256 |
Workflow
- Get your Sophos Client ID and Client Secret.
- Configure the Sophos plugin.
- Configure Sharing for Netskope and Sophos.
- Validate the Sophos Plugin.
Click play to watch a video.
Get your Sophos Client ID and Client Secret
- Log in to your Sophos Account.
- Go to Global Settings and click API Credentials.
- Enter a name for your credential set and a description, and then click Add.
- Click Copy to save the Client ID, and then click Show the Client Secret to unhide the value.
- Click Copy to save the Client Secret. These two values are needed for the Sophos plugin configuration.
Configure the Sophos Plugin
- In Cloud Exchange, go to Settings > Plugins.
- Search for and select the Sophos plugin box to open the plugin creation page.
- Enter a Configuration Name.
- Adjust the Sync Interval to the appropriate value: Suggested is 5+ minutes.
- Enter an Aging Criteria.
- Adjust the Override Reputation to the appropriate value.
- Click Next.
- Enter your Sophos Client ID and Client Secret.
- Click Save.
Configure Sharing for Netskope and Sophos
- In Threat Exchange, go to Sharing.
- Click Add Sharing Configuration.
- For Source Configuration, select the Sophos plugin you just created.
- Select an appropriate Business Rule from the dropdown.
- For Destination Configuration, select Netskope.
- For Target, select Add to File Hash List from the dropdown and enter a name and size.
- Click Save.
