Security Onion Sophos Syslogs

[Tom109123]

Hi All,

Currently I have setup Security Onion, and I am trying to setup Sophos XG syslogging.
The issue that I am facing is that the Syslogs are flowing into Security Onion fine, however, parsing is not working correctly.

See: [https://discuss.elastic.co/t/es-7-15-filebeats-sophos-xg-module-not-separating-data-into-variables/288577]
However, I am not able to fix this issue Within SO.
All data is shown in the "message" field, and not splitup in seperate fields.

Can someone point me in the right direction?

[dougburks]

Have you tried using the Filebeat module for Sophos?
https://docs.securityonion.net/en/2.3/filebeat.html#modules
https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-module-sophos.html

[Tom109123]

Thanks, Filebeat module works!