Integration: Kaseya MDR and Sophos

Kaseya MDR

NAVIGATION  At the partner level: Settings > Integrations > + New Integration > choose organization > Next > Sophos

NAVIGATION  At the organization level: Organizations > Edit Organization (pencil icon) > + New Application > Sophos

PERMISSIONS  Permission to manage integrations or organization applications in Kaseya MDR

Sophos Central Partner

NAVIGATION  Configure > Settings & Policies > API Credentials

PERMISSIONS  Access to Sophos threat data. Partner Super Admin includes the required permissions by default. For custom roles, grant Full access to Endpoint and Server Protection and Enable access to logs and alerts.

To generate the API credentials required for the integration, complete the following steps:

1. Log in to Sophos Central Partner.

2. Go to Settings & Policies > API Credentials.

   

3. Click Add Credentials.

   

4. Enter a name and description, for example, Kaseya MDR, and then click Add.

   

5. Copy the Client ID and click Show Client Secret.

   

6. Copy the Client Secret.

   

1. In Kaseya MDR, navigate to Settings > Integrations.

   

2. Click + New Integration.

   

3. Select the organization that will receive the Sophos data, and then click Next.

   

   • To create a new organization and use it for the integration, click Create New Organization and use.

   • Each organization can have one connection per application type.

4. Under Endpoint Security, locate Sophos and click Connect.

   

5. Enter the Client ID and Client Secret generated in Sophos Central Partner.

   

6. Click Next.

7. Complete the Organization Mapping step and save the integration.

When configured at the partner level, Sophos Monitor appears in Settings > Integrations with a Connected status and displays the associated organization.

1. In Kaseya MDR, from the side navigation menu, go to Organizations.

   

2. Click Edit Organization (pencil icon) for the organization you want to connect Sophos to.

   

3. Click +New Application.

   

4. Under Endpoint Security, locate Sophos and click Connect.

   

   NOTES  Partner-level configuration is recommended. Configuring the same Sophos Monitor instance for multiple organizations may result in duplicate events and alerts.

5. Enter the Client ID and Client Secret generated in Sophos Central Partner.

   

6. Click Next.

7. Complete the Organization Mapping step and save the integration.

When configured at the organization level, the Sophos application appears under the organization's Applications tab.

To disable the integration:

1. Navigate to the Sophos integration.

   • If the integration was configured at the partner level, go to Settings > Integrations, locate Sophos, and select View details.

   • If the integration was configured at the organization level, go to Organizations, select the organization, and then open the Applications tab.

2. Select Disconnect Application.

   

3. Confirm the action.

   

Results

• Sophos activity is no longer associated with organizations in Kaseya MDR.

• Existing Sophos deployments and configurations remain unchanged.

• If Sophos is configured at the partner level, disconnecting it affects all organizations mapped to that connection.

The integration can be reconnected later using the same workflow, if needed.

No. This integration requires API credentials generated from Sophos Central Partner. Sophos Central Admin (tenant-level) credentials are not supported and will result in an error during configuration.

A custom role must have:

• Endpoint and Server Protection: Full

• Feature: Enable access to logs and alerts

Partner Super Admin includes the required permissions by default.