config.ini.sample

[login]
# API Access URL + Headers
# API token setup steps: https://community.sophos.com/kb/en-us/125169
token_info = <Copy API Access URL + Headers block from Sophos Central here>


# Client ID and Client Secret for Partners, Organizations and Tenants
# <Copy Client ID and Client Secret from Sophos Central here>
client_id = 
client_secret = 
# Customer tenant Id
tenant_id = 

# Host URL for Oauth token
auth_url = https://id.sophos.com/api/v2/oauth2/token

# whoami API host url
api_host = api.central.sophos.com

# format can be json, cef or keyvalue
format = json

# filename can be syslog, stdout, any custom filename
filename = result.txt

# endpoint can be event, alert or all
endpoint = event

# syslog properties
# for remote address use <remoteServerIp>:<port>, for e.g. 192.1.2.3:514
# for linux local systems use /dev/log
# for MAC OSX use /var/run/syslog
# append_nul will append null at the end of log message if set to true
address = /var/run/syslog
facility = daemon
socktype = udp
append_nul = false

# cache file full or relative path (with a ".json" extension)
state_file_path = state/siem_sophos.json

# Delay the data collection by X minute to avoid events missing issue from Sophos API
# The issue could be due to some specific host being ahead in time for a few minute and Sophos Central would consider events received from that host as a checkpoint.
events_from_date_offset_minutes = 0

# Delay the data collection by X minute.
alerts_from_date_offset_minutes = 0

# Convert the dhost field to valid fqdn.
convert_dhost_field_to_valid_fqdn = true


#logging level
logging_level = DEBUG