Sophos

The CrowdSec Sophos integration connects CrowdSec's hosted blocklist endpoint to your Sophos firewall.
Sophos calls this feature Third-Party Threat Feeds, which enable you to integrate external sources of IP addresses, domains, and URLs involved in threat activity.

Ensure your Sophos device supports Third-Party Threat Feeds.
The vendor documentation is available in the References section below.

Step 1 — Create the integration in the CrowdSec Console

In the Integrations page, click Connect under the Sophos card.

Name the integration (must be unique to your account), then click Create.

The credentials shown next are displayed only once. Copy them before closing this screen.

You now have an HTTPS endpoint and Basic Auth credentials to configure on your Sophos device.

Manage integration size limits with pagination

If you want to learn how to manage integration size limits with pagination, please refer to the Managing integrations size limits with pagination section.

References

• Sophos — Third-Party Threat Feeds documentation
• Video — Sophos & CrowdSec integration walkthrough

Next Steps

Subscribe to blocklists in the Blocklist Catalog to populate your integration.