> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rallied.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sophos Central

> Connect your Sophos Central partner account so the agent can check customer firewalls, find which customer an alert belongs to, and read open Sophos alerts.

Connect your Sophos Central partner account and the agent works Sophos alerts without a technician opening the Sophos console.

When a "firewall lost connection" alert arrives, the agent finds the customer, checks whether the firewall has reconnected, and reads the alerts Sophos Central still holds. It also reports firewall model, firmware and HA cluster state. The integration is read-only. Rallied never changes anything in Sophos Central.

## Prerequisites

* A **Sophos Central Partner** account. Rallied rejects credentials created in a single customer's Sophos Central account, because they can't see your other customers.

## How to connect

**1. Create a read-only API credential**

Sign in to Sophos Central Partner. Open **Settings → API Credentials Management** and click **Add Credential**. Choose the **Service Principal Read-Only** role. Copy the **Client ID** and **Client Secret**. Sophos shows the secret only once.

**2. Connect Sophos Central**

In Rallied, go to **Settings → Integrations**, find the Sophos Central card and click **Connect**. Enter the **Client ID** and **Client Secret** from your Sophos API credential.

**3. Save and confirm**

Click **Save**. Rallied validates the credential, confirms it's a partner-level credential, and syncs your customer tenants. The card shows **Connected** when it's ready.

If you no longer have the secret, create a new credential in Sophos Central Partner and reconnect.

## Mapping tenants to clients

When you connect, Rallied syncs the customer tenants in your partner account. Review how each tenant maps to a Rallied client on the **Companies** tab of the integration's detail page. Click **Sync tenants** to pick up customers you've added since.

On a client's ticket, the agent reads only that client's tenant. It fills in the tenant ID automatically.

Searching across every tenant is limited to the MSP admin [Chat](/dashboard/chat.md) and tickets on your PSA's catch-all client, where alerts for an unknown customer usually land. End users can't run any Sophos Central tool.

## How the agent uses it

A typical "gateway down" alert arrives on the catch-all client with only a firewall name. The agent:

1. Finds the firewall's customer by searching each tenant's firewalls for the name, hostname, or serial number. If the alert names the customer, the agent searches only matching tenants, which is faster.
2. Checks whether the firewall is connected to Sophos Central now.
3. Lists the customer's alerts to see whether Sophos Central still holds the alert. An alert that's no longer listed has most likely been cleared or acknowledged.

On large partner accounts, a firewall search covers up to 30 tenants per call and continues where it left off. The agent doesn't report "not found" until it has searched every tenant.

## Tools

Every tool defaults to **Auto**. To change a default, open the **Policies** tab on **Settings → Integrations → Sophos Central**. See [Approval settings](/dashboard/policies.md).

| Tool | Default policy | Description |
| - | - | - |
| `sophos_central:sophos-list-tenants` | Auto | List the customer tenants in your partner account. Admin chat or catch-all client only |
| `sophos_central:sophos-find-tenant` | Auto | Find a customer tenant by name or part of a name. Admin chat or catch-all client only |
| `sophos_central:sophos-find-firewall` | Auto | Find which customer a firewall belongs to by name, hostname, or serial number. Admin chat or catch-all client only |
| `sophos_central:sophos-list-firewalls` | Auto | List a customer's firewalls and whether each is connected now |
| `sophos_central:sophos-list-alerts` | Auto | List a customer's open alerts, filtered by product, category, severity, or time |
| `sophos_central:sophos-get-alert` | Auto | Get one alert by ID |

## See also

* [Approval settings](/dashboard/policies.md)
* [Chat](/dashboard/chat.md)
* [Integrations](/dashboard/integrations.md)
* [Integrations overview](/integrations/overview.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.