• Sophos Monitoring Software
• File Integrity Monitoring Sophos
• Sophos Fim

File Integrity Monitoring lets you monitor files, folders, registry keys, or registry values for changes.

This monitoring helps you comply with security requirements like PCI DSS.

To set up a policy, do as follows:

Sophos Monitoring Software

1. Go to Server Protection > Policies.
2. Create a File Integrity Monitoring policy or edit the Base Policy.
3. Open the policy's Settings tab.
4. Select Use File Integrity Monitoring.

By default, we monitor critical Windows system files. You can set up custom monitoring if you want to monitor other locations.

Sophos Anti-Virus for Linux is free and compatible with most major 64-bit Linux distributions, including CentOS, Debian, Red Hat, SUSE and Ubuntu, but it isn't integrated into the PC and Mac software. To avoid this happening again, Sophos advises to configure Suspicious Behaviour Monitoring to alert only mode for the duration of software installations/updates. If the software often updates, add it to the list of authorized programs instead. Is the reported file new to the computer or network Has it been there for years? If not, how did it. 2) is there any way in monitoring or getting the data from Enterprise Console to alert in Solarwinds either via SNMP / WMI / PerfMon etc as we spend more time in front of the solarwinds console then the Sophos Console so moving the alerts to a single pannel makes alot of sence.

Custom monitoring

To monitor a location, do as follows.

1. Go to Custom monitoring.
2. Click Add location.
3. In Add location, select the item Type.
   Note If you select Folder, we monitor the folder and the files in it by default. To monitor only the files in the folder, deselect Monitor changes to the folder as well as the files.
   Note If you select Registry Key, we monitor the key but not the values in it. You must use the location type Registry Value to monitor values.

   You can use variables.

4. Click Add or Add Another.

To edit a location already in the list, click its path and update the details.

To delete a location from the list, click the cross on the right.

Monitoring exclusions

To exclude a location from monitoring, do as follows.

1. Go to Monitoring exclusions.
2. Click Add exclusion.
3. In Add exclusion, select the item Type.
   Note If you select Folder, you exclude the folder and the files in it.
   Note If you select Registry Key, you exclude the key and the registry values within it.

   You can use variables.

4. Click Add or Add Another.

To edit a location already in the list, click its path and update the details.

To delete a location from the list, click the cross on the right.

Gaining Internet activity insights and keeping abreast about security events is a challenging task as the security appliance generates a huge quantity of security and traffic logs. With a package of features, Firewall Analyzer's Sophos reporting capability fit like a glove enabling you to strengthen the network security. Firewall Analyzer lets you collect, archive, analyze Sophos device logs and generate security and forensic reports.

Sophos firewall security and capacity management

With Firewall Analyzer, a Sophos firewall monitoring toll, you can access predefined reports that help in analyzing bandwidth usage and understanding security and network activities. These reports help you to study the security vulnerability with top denied hosts, blocked URL hits, attacks, targets, virus, affected hosts, spam, receiving hosts.

Sophos firewall bandwidth capacity planning

Sophos firewall trend reports in Firewall Analyzer trace patterns in network behavior and bandwidth usage over time. Analysis of trend reports gives better insight into the nature of web site traffic or network traffic, and helps you make decisions on capacity planning, business risk assessment, bandwidth management, traffic shaping, and network security posture.

Sophos firewall bandwidth monitoring

Firewall Analyzer, a Sophos bandwidth monitor tool, provides a unique way to monitor the Internet traffic of the network in near real-time. Firewall traffic data is collected and analyzed to get granular details about the traffic across each firewall. There is no requirement for any probes or collection agents to get these details on the traffic.

Sophos traffic analyzer

File Integrity Monitoring Sophos

Firewall Analyzer is a Sophos traffic monitor tool. It measures network traffic based on the analysis of logs received from different network firewalls. Firewall logs are collected, archived, and analyzed to get granular details about traffic across Sophos firewall devices.

Employee internet usage monitoring

Sophos Fim

With Firewall Analyzer for Sophos, you can maximize the business usage of Internet bandwidth using employee Internet monitoring. You can fine tune the Firewall policies to block or restrict bandwidth guzzling web sites and effectively control employee Internet usage. This will ensure that the bandwidth is available for smooth functioning of the business.

Sophos firewall alerts

Apart from exhaustive firewall reports with respect to network security, Firewall Analyzer offers comprehensive alarms and notifications.
The Sophos firewall log viewer tool generates alarms for anomalous security criteria, bandwidth values, and any normal criteria of security interest.
Alarms can be notified via email and SMS. It can trigger a script to achieve various threat mitigation activities. Alarms are also displayed in the UI screen.

To configure Sophos firewalls, refer the Sophos UTM and Sophos XG help pages.
Firewall Analyzer Sophos reports provide a unified solution to manage your organization's network security. The reports help you safeguard your network from external vulnerabilities. Download a 30-day free trial version of Firewall Analyzer today!

Sophos supported versions