Sophos Central log source parameters for the Sophos Central DSM

If QRadar does not automatically detect the log source, add a Sophos Central log source on the QRadar Console by using the Sophos Central protocol.

Configure specific parameters when you are using the Sophos Central protocol.

The following table describes the parameters that require specific values to collect the Sophos Central events from Sophos:

Table 1. Sophos Central log source parameters for the Sophos Central DSM
Parameter	Value
Log Source type	Sophos Central
Protocol Configuration	Sophos Central
Log Source Identifier	Type a unique name for the log source. The Log Source Identifier can be any valid value and does not need to reference a specific server. The Log Source Identifier can have the same value as the Log Source Name. If you have more than one configured log source per DSM, ensure to give unique name to each log source.

For a complete list of Sophos Central protocol parameters and their values, see Sophos Central protocol configuration options.

For more information about the protocol parameters and their values, see Adding a log source.