Sophos
The Sophos Source works by polling your event/alert logs every 60 seconds.
To connect your source, generate an API Token from your Sophos Central account and add it to new RunReveal source in the sources dashboard
![](/sophos-1.png)
Enter the API Access URL that Sophos provides, and copy the generated Headers into the Headers field.