Sophos XG Integration not working correctly

[dLoProdz]

Sophos XG intergration seems to be broken.

After connecting a Sophos XG firewall to the UTMS instance by using the provided integration:

1. The data source type appears as 'Generic'
2. Logs ARE received, but there is a _grokparsefailure

Expected behavior

I would expect the integration not only to recognize the correct device type but also to successfully parse and decode the logs for effective field extraction.

Environment

• OS: UTMS running on Ubuntu 22.04,
• OS: Sophos SFVH (SFOS 20.0.2 MR-2-Build378)
• Browser: Firefox, Chrome
• Version: 10.5.7

[osmontero]

I will move this to discussions until it become confirmed as a bug

[Kbayero]

Hello @dLoProdz . Could you please provide this logs that you received as generic? Like this we can check what is happening. Please make sure that you remove any sensitive data before send it.

[dLoProdz]

@timestamp
Sep 5, 2024, 7:36:22 PM

@version
1

dataSource
...

dataType
generic

deviceTime
Sep 5, 2024, 7:36:22 PM

host
...

id
...

message
<30>device_name="..." timestamp="2024-09-05T13:36:21-0600" device_model="SFVH" device_serial_id="..." log_id="..." log_type="Firewall" log_component="Firewall Rule" log_subtype="Allowed" log_version=1 severity="Information" duration=33 fw_rule_id="..." fw_rule_name="..." fw_rule_section="Local rule" nat_rule_id="..." nat_rule_name="..." fw_rule_type="USER" gw_id_request=1 gw_name_request="..." ips_policy_id=5 app_filter_policy_id=6 app_name="DNS" app_risk=1 app_technology="Network Protocol" app_category="Infrastructure" ether_type="..." in_interface="..." out_interface="..." src_mac="..." dst_mac="..." src_ip="..." src_country="..." dst_ip="8.8.8.8" dst_country="USA" protocol="UDP" src_port=... dst_port=53 packets_sent=1 packets_received=1 bytes_sent=59 bytes_received=144 src_trans_ip="..." src_zone_type="LAN" src_zone="..." dst_zone_type="WAN" dst_zone="..." con_event="Stop" con_id="..." hb_status="No

tags.0
_grokparsefailure

[c3s4rfred]

Hi @dLoProdz according with the log example that you provided, that log structure is not supported by the integration, the latest supported version is 18.5, we will take a note about that and possibly work on an upgrade.

Best regards

[dLoProdz]

Understood, thanks for your support.

[c3s4rfred]

Also, since version 19.5 doesn't have much changes over 18.5, it's possible that devices with 19.5 work as well.