Sophos Enterprise Console
JSA has two options for gathering events from a Sophos Enterprise Console by using JDBC.
The Sophos Enterprise Console DSM for JSA accepts events by using Java Database Connectivity (JDBC).
JSA records all relevant anti-virus events. This document provides information on configuring JSA to access the Sophos Enterprise Console database by using the JDBC protocol.
To use the Sophos Enterprise Console protocol, you must ensure that the Sophos Reporting Interface is installed with your Sophos Enterprise Console. If you do not have the Sophos Reporting Interface, you must configure JSA by using the JDBC protocol. For information on installing the Sophos Reporting Interface, see your Sophos Enterprise Console documentation.
To gather events from a Sophos Enterprise Console:
Select the method that best applies to your Sophos Enterprise Console installation:
Configuring the Database View
To integrate JSA with Sophos Enterprise Console:
Log in to your Sophos Enterprise Console device command-line interface (CLI).
Type the following command to create a custom view in your Sophos database to support JSA:
CREATE VIEW threats_view AS SELECT t.ThreatInstanceID, t.ThreatType, t.FirstDetectedAt, c.Name, c.LastLoggedOnUser, c.IPAddress, c.DomainName, c.OperatingSystem, c.ServicePack, t.ThreatSubType, t.Priority, t.ThreatLocalID, t.ThreatLocalIDSource, t.ThreatName, t.FullFilePathCheckSum, t.FullFilePath, t.FileNameOffset, t.FileVersion, t.CheckSum, t.ActionSubmittedAt, t.DealtWithAt, t.CleanUpable, t.IsFragment, t.IsRebootRequired, t.Outstanding, t.Status, InsertedAt FROM <Database Name>.dbo.ThreatInstancesAll t, <Database Name>.dbo.Computers c WHERE t.ComputerID = c.ID;
Where <Database Name> is the name of the Sophos database.
Note:The database name must not contain any spaces.
After you create your custom view, you must configure JSA to receive event information that uses the JDBC protocol or the Sophos Enterprise Console JDBC protocol.
Sophos Enterprise Console JDBC Log Source Parameters for Sophos Enterprise Console
If JSA does not automatically detect the log source, add a Sophos Enterprise Console log source on the JSA Console by using the Sophos Enterprise Console JDBC protocol.
When using the Sophos Enterprise Console JDBC protocol, there are specific parameters that you must use.
The following table describes the parameters that require specific values to collect Sophos Enterprise Console JDBC events from Sophos:
Parameter |
Value |
|---|---|
Log Source Type |
Sophos Enterprise Console |
Protocol Configuration |
Sophos Enterprise Console JDBC |
Log Source Identifier |
Type the identifier for the log source. Type the log source identifier in the following format: <Sophos Database>@<Sophos Databas Server IP or Host Name>, where:
When you define a name for your log source identifier, you must use the values of the Sophos Database and Database Server IP address or host name from the Management Enterprise Console. |
JDBC Log Source Parameters for Sophos Enterprise Console
If JSA does not automatically detect the log source, add a Sophos Enterprise Console log source on the JSA Console by using the JDBC protocol.
When using the JDBC protocol, there are specific parameters that you must use.
The following table describes the parameters that require specific values to collect JDBC events from Sophos Enterprise Console:
Parameter |
Value |
|---|---|
Log Source Type |
Sophos Enterprise Console |
Protocol Configuration |
JDBC |
Log Source Identifier |
Type the IP address or host name for the log source as an identifier for events from your Sophos Enterprise Console devices. |