> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Sophos Central

> Ingest Sophos Central alerts, events, and endpoints

<Info>
  Sophos Central is currently in **beta**
</Info>

To integrate Sophos Central, you will need to create API credentials in the Sophos Central console and provide the resulting **Client ID** and **Client Secret** to Wirespeed.

## Prerequisites

* Sophos Central admin access with the ability to manage API Credentials
* An API credential with the **Service Principal Management** role.
* Sophos Intercept X / Sophos Central with SIEM Integration enabled (required for alerts and events APIs)

## Create API Credentials

1. Log in to the [Sophos Central Admin console](https://central.sophos.com/)
2. Open **Settings & Policies** > **API Credentials Management**
3. Click **Add Credential**
4. Name the credential and assign the **Service Principal Management** role
5. Click **Add**
6. Copy the **Client ID** and **Client Secret** that are displayed

<Warning>
  The Client Secret is shown **only once** at credential creation time. If you lose it, regenerate the credential in Sophos Central.
</Warning>

## Add the Integration in Wirespeed

1. In Wirespeed, navigate to **Integrations** > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Sophos Central**
2. Paste in your **Client ID** and **Client Secret**
3. Submit the integration

On connect, Wirespeed exchanges the credentials for a bearer token at `https://id.sophos.com/api/v2/oauth2/token`, then calls `https://api.central.sophos.com/whoami/v1` to discover and cache:

## What Wirespeed Ingests

| Source    | Sophos API                   | Purpose                                                                  |
| --------- | ---------------------------- | ------------------------------------------------------------------------ |
| Alerts    | `GET /common/v1/alerts`      | Threat detections (malware, ransomware, exploit, behavioral)             |
| Events    | `GET /siem/v1/events`        | Endpoint telemetry (IPS, AMSI, application control)                      |
| Endpoints | `GET /endpoint/v1/endpoints` | Managed endpoint inventory for asset correlation and isolation targeting |

## Response Actions

Wirespeed can isolate and unisolate Sophos-managed endpoints.