Initialize the Sophos Central Beat

This guide outlines the steps required to initialize the Sophos Central Beat using the Open Collector.

Prerequisites

• The Open Collector is installed. If you have not already installed it, follow the instructions in the Open Collector Installation and User Guide, and then return to this topic.

• The ClientID and ClientSecret keys obtained from the Sophos web console during the steps outlined in Configure Sophos Central.

• The following port is open:

  Direction	Port	Protocol	Source
  Outbound	443	HTTPS	sophoscentralbeat

  
  

  The steps outlined in this guide describe the Sophos Central Beat setup process using a Client ID and Client Secret, which are needed to configure Sophos Central Beats for version 7.0.0 and later. If you are currently using Sophos Central Beat version 6.0.3 or earlier, upgrade to Sophos Central Beat version 7.0.0 (or later), along with LRCTL version 6.6.0 (or later).

  When upgrading to Sophos Central Beat version 7.0.0 or later, ensure all existing instances are closed before launching a new one. Note that versions 7.0.0 and above are not backward compatible with the 6.x.x series.

  
  

Initialize the Beat

1. To confirm the Open Collector is running, run the following command:

   ./lrctl status
   

   You should see the open_collector and metrics as shown in the following graphic:
   

   If the Open Collector is not running correctly, see

   Troubleshoot the Open Collector

   in the Open Collector Installation and User Guide.

   
   

2. In the Open Collector, run the following command:

   ./lrctl sophoscentralbeat start
   

   
   

3. Select New sophoscentralbeat instance and provide a unique name.

4. Enter the following details:
   

   The ClientID and ClientSecret configuration fields are saved in encrypted format.

   1. Enter the ClientID for the Sophos Central beat.
      

      

   2. Then enter the ClientSecret for the Sophos Central beat.
      

5. Save the configuration.
   The Sophos Central Beat service starts successfully.

6. To check the status of the service, run the following command:
   

   ./lrctl sophoscentralbeat status
   

   

Default Config Values for Sophos Central Beat