Configure Sophos Central

Generate the API Token

The following information is required to configure Sophos Central for Beats:

These three configuration keys are created by generating the API Token from the Sophos Central web console.

Open the Sophos Central web console: https://central.sophos.com/manage/login.
In the menu on the left, select Global Settings.
In the center pane, click API Token Management, and then click Add Token.
The Add Token dialog box appears.
Enter a Token Name and click Save.

The token is generated and appears on the API Token Summary screen.
Copy the URL, x-api-key, and authorization required to configure Sophos Central.

The generated token applies to all products. Therefore, after you generate a token, logs for all products are available in the Beat. No extra configuration is required when additional products are added.
Copy the Authorization Key with the Basic prefix. Not using the required Basic prefix in the authorization key will result in a 401 unauthorized error in the Beat.

The following installation takes 10–15 minutes.

In the menu on the left, select Protect Devices.
In the center pane, click Choose Components.
The Component Installation Options dialog box appears.
From the list of products provided, select the products you want your installer to register for, and then click Download Installer.
After the installer is downloaded, double click the executable to install Sophos Central on your machine.

In some cases, you will be prompted to restart your system. Installation resumes automatically after your system restarts.
To verify the installation and registration in Sophos Central, from the menu on the left, select Endpoint Protection.
Select the name of the product installer you downloaded, and from the menu on the left, select Computers.
The list of systems registered appears.

Logs are generated when a user visits a malicious link.

A Sophos Alert notification appears on screen, blocks access to the link, and generates a log in Sophos Central.

In the menu on the left, select Endpoint Protection, and then select Computers.
The list of registered systems appears in the center pane.
Select the system you want.
On the Summary Tab, click View More.
To view a detailed list of logs, click View Events Report.

A list of logs for the selected system appears.
Use the filters at the top of the center pane to configure the log set for export.
To Export logs, on the bottom of the screen on the right, click Export.
Select the report format, and the logs export begins.