Integration
Sophos Central in IDA: protection status next to the ticket
Tamper protection switched off on a machine is the kind of thing you notice when someone happens to look. IDA fetches the state from Sophos Central and puts it where the work happens - on the device, at the customer.
BetaThis integration is built and usable, but has not yet run against a production third-party system - it was written against the vendor’s public interface documentation. Expect some follow-up work on first connection. We would rather say so up front than let you find out.
What IDA reads from Sophos Central
- Devices per customer with hostname, type, operating system, IP and logged-in user
- Overall endpoint health (good, suspicious, bad)
- Tamper protection on or off
- When the device was last seen
What IDA does with it
- Protection status sits on the customer device - no second portal while working a ticket
- Devices that have not reported in for a while stand out instead of going unnoticed
- An endpoint without tamper protection is a line in a report, not a chance discovery
Who it is for
Providers running Sophos Central who want the state in the service desk rather than in a console nobody is watching.
Setup: Store API credentials (client ID and secret from Sophos Central). IDA works out by itself whether it is a partner, organisation or single-tenant account.
Every integration in IDA has its own switch. Turn it off and it disappears completely - including the columns, filters and reports that belong to it. You only see what you actually use.
Vendor website: Sophos Central. Sophos Central is a trademark of its respective owner; IDA connects to the system technically, which implies no partnership.
Related
- Bitdefender GravityZone - Security & backup
- ESET PROTECT - Security & backup
Questions about the Sophos Central integration
Does IDA write back to Sophos?
No. The integration is read-only - it fetches state, it changes no policy and triggers no action.
Does this replace GravityZone or ESET?
No, and it does not exclude them. One customer runs Sophos, the next GravityZone - in IDA they sit side by side, each customer with their own source.
How current is the data?
Every 12 hours by default. Protection status rarely changes by the minute, and polling harder only loads both sides.
Everything in one interface - for you too
30 days free, no payment details. Every integration is included at no extra cost.