> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Sophos Firewall

> Forward syslog events from Sophos Firewall (SFOS)

> [!NOTE]
>
> This page covers syslog from the Sophos Firewall appliance (SFOS). For Sophos Central endpoint detections, see [Sophos Central](https://docs.wirespeed.co/integrations/sophos.md).

## Set up

1. Follow the shared [Log Forwarders](https://docs.wirespeed.co/integrations/log-forwarders.md) guide to add **Sophos Firewall** and open **Forwarder Details** (or ask Chat for the listener `ip:port`). Sophos sends syslog over UDP, or over TLS when secure log transmission is on. It can't send to a plain TCP listener
2. In the Sophos Firewall web admin console, go to **System services** > **Log settings** and click **Add** in the **Syslog servers** section. You can add up to five syslog servers
3. Enter a **Name**, and set **IP address/domain** and **Port** to the values from **Forwarder Details**
4. If **Forwarder Details** shows **TLS: Enabled**, turn on **Secure log transmission**. Otherwise leave it off, and the firewall sends over UDP
5. Set **Format** to **Standard syslog protocol** (called **Central Reporting Format** on SFOS 19.0). The legacy **Device standard format** is also parsed
6. Set **Facility** to **DAEMON** and **Severity level** to **Information**, then click **Save**
7. On **Log settings**, find the column for the new syslog server, select every log type in it (Wirespeed parses each of them), and click **Apply**
8. Events will begin showing up shortly

If **Forwarder Details** shows **TLS: Enabled**, enter Wirespeed's listener as a domain name. The firewall checks that the certificate's Common Name (or, with LINCE mode on, its Subject Alternative Name) matches that domain. See [Syslog over TLS](https://docs.wirespeed.co/integrations/log-forwarders.md#syslog-over-tls).

## Time zones

The standard syslog protocol sends `timestamp` with its UTC offset. The legacy device format sends `date` and `time` in the firewall's local time with a time zone abbreviation (for example `timezone="CEST"`). Use the standard syslog protocol to avoid time zone offsets.

## Parsed events

Wirespeed parses firewall rule, content filtering (web and SSL/TLS inspection), application control, IPS, ATP, anti-malware, anti-spam, VPN, and system events into dedicated fields keyed by `log_type`, `log_component`, and `log_subtype`. Web admin and SSH console logins, as well as firewall, VPN, and user portal authentication events, are normalized as sign-ins. Fields without a dedicated column are kept in `unmapped`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.