Actions for Sophos Central #
- Send Data to Sophos Central. Sends a custom set of Lucidum data to Sophos Central.
Use Cases #
Below are the possible use cases for these actions:
-
If you want to run Lucidum “headless”, you can send relevant data to Sophos Central on a regular schedule.
- You can send normalized, enriched Lucidum data to Sophos Central to be indexed, searched, and analyzed.
Prerequisites #
To execute Sophos Central actions, you must:
- Configure a Sophos Central API connection beforehand. The required parameters are described in the instructions for creating a Sophos Central connector in Lucidum https://lucidum.io/docs/sophos-central/.
NOTE. The specified account should have read and write permissions.
Workflows #
- Creating a new Configuration and a new Action
- Cloning an Existing Action
- Creating a new Action from the Location Results page
- Editing a Configuration
- Editing an Action
- Viewing Information about an Action
Sophos Central Configuration #
To create a configuration for Sophos Central actions:
-
Configuration Name. Identifier for the Configuration. This name will appear in the Lucidum Action Center.
-
URL. The URL for the Sophos Central API. For example, https://api-lucidum.central.sophos.com.
-
Client ID. Client ID for a Sophos Central account with the role Service Principal Management. For details, see https://docs.sophos.com/central/partner/help/en-us/Help/Configure/SettingsAndPolicies/APICredentials/index.html.
-
Client Secret. Client Secret for a Sophos Central account with the role Service Principal Management.
- Max # of Records per Payload. The maximum number of records to send to Sophos Central in each action. The default value is “50”.
Create a New Action #
To create an action for Sophos Central, contact Lucidum customer care.
