Skip to main content
Connect your Sophos Central partner account and the agent works Sophos alerts without a technician opening the Sophos console. When a “firewall lost connection” alert arrives, the agent finds the customer, checks whether the firewall has reconnected, and reads the alerts Sophos Central still holds. It also reports firewall model, firmware and HA cluster state. The integration is read-only. Rallied never changes anything in Sophos Central.

​
Prerequisites

  • A Sophos Central Partner account. Rallied rejects credentials created in a single customer’s Sophos Central account, because they can’t see your other customers.

​
How to connect

1

Create a read-only API credential

Sign in to Sophos Central Partner. Open Settings → API Credentials Management and click Add Credential. Choose the Service Principal Read-Only role. Copy the Client ID and Client Secret. Sophos shows the secret only once.
2

Connect Sophos Central

In Rallied, go to Settings → Integrations, find the Sophos Central card and click Connect. Enter the Client ID and Client Secret from your Sophos API credential.
3

Save and confirm

Click Save. Rallied validates the credential, confirms it’s a partner-level credential, and syncs your customer tenants. The card shows Connected when it’s ready.
If you no longer have the secret, create a new credential in Sophos Central Partner and reconnect.

​
Mapping tenants to clients

When you connect, Rallied syncs the customer tenants in your partner account. Review how each tenant maps to a Rallied client on the Companies tab of the integration’s detail page. Click Sync tenants to pick up customers you’ve added since. On a client’s ticket, the agent reads only that client’s tenant. It fills in the tenant ID automatically. Searching across every tenant is limited to the MSP admin Chat and tickets on your PSA’s catch-all client, where alerts for an unknown customer usually land. End users can’t run any Sophos Central tool.

​
How the agent uses it

A typical “gateway down” alert arrives on the catch-all client with only a firewall name. The agent:
  1. Finds the firewall’s customer by searching each tenant’s firewalls for the name, hostname, or serial number. If the alert names the customer, the agent searches only matching tenants, which is faster.
  2. Checks whether the firewall is connected to Sophos Central now.
  3. Lists the customer’s alerts to see whether Sophos Central still holds the alert. An alert that’s no longer listed has most likely been cleared or acknowledged.
On large partner accounts, a firewall search covers up to 30 tenants per call and continues where it left off. The agent doesn’t report “not found” until it has searched every tenant.

​
Tools

Every tool defaults to Auto. To change a default, open the Policies tab on Settings → Integrations → Sophos Central. See Approval settings.

​
See also