Sophos

The Sophos Source works by polling your event/alert logs every 60 seconds.

To connect your source, generate an API Token from your Sophos Central account and add it to new RunReveal source in the sources dashboard

Enter the API Access URL that Sophos provides, and copy the generated Headers into the Headers field.