Overview 

Our primary objective is to achieve optimal visibility into our client's environment. The incorporation of Sophos with the Cognna platform enhances our ability to obtain a thorough perspective on your infrastructure's security. This integration empowers us to efficiently analyze and triage events related to firewall.

To achieve this integration, we will configure the FW to push the logs to the collector server that you created earlier

1. Head to the Sophos firewall interface, once we have logged in, Go to System services > Log settings, click Add

1. Within the “Log setting” section, we will specify the name, IP address, port, facility, severity level, and format as the following:

This figure is for demonstration purposes only. Please fill the cells as mentioned in the previous table.

1. Click Save. And from Log settings select the logs you want to send to the syslog server (Syslogs), then click Apply.
   

1. Now, the last step is to ensure that the firewall policy is not denying the connection to the collector server. You can achieve this by creating a policy that ensures communication to the server.

Frequently Asked Questions

What parameters are required prior to initiating configuration?

Before configuring your firewall, please ensure the following details have been gathered:

1. Collector Server IP: The network address for your designated log collector host.
2. Destination Port: The assigned Syslog port (typically 9014) designated by Cognna.
3. Protocol Type: Transport layer mechanism (TCP or UDP) arranged for transmission.
4. Network Path: Verification that firewalls permit traffic flow to the destination collector.
5. Log Selection: Identification of specific event categories required for operational analysis.

Core Integration Requirements

1. Agentless Setup: Uses native Syslog protocol directly from your security appliance without extra software.
2. Connection Details: Requires collector IP address, Syslog port (default: 9014), and agreed protocol settings.
3. Log Configuration: Head to System services > Log settings to define destinations and enable security log forwarding.
4. Routing Validation: Ensure routing rules and access policies allow traffic to reach the target collector server.

Verification & Diagnostic Steps

1. Outbound Traffic Check: Open Advanced Shell and execute the packet capture command:

tcpdump -ni any host <COLLECTOR_IP> and port <PORT>

1. Inbound Traffic Check: On your Linux collector instance, confirm packet arrival using:

sudo tcpdump -ni any 'host <FIREWALL_IP> and port <PORT>'

1. Platform Processing: Verify local service status and contact Cognna to confirm successful log ingestion.

Troubleshooting Overview