Sophos XG Firewall v2

LAST UPDATED: MAY 6, 2025

Overview

Sophos XG Firewall is a next-generation firewall (NGFW) that delivers advanced threat protection, network security, and comprehensive visibility across environments ranging from small businesses to large enterprises.

READER NOTE

This integration is developed against version 21.0 of the API. Compatibility with earlier or later versions is contingent upon changes to the official API endpoints. Consequently, functionality in other versions is not guaranteed and requires thorough validation prior to deployment.

D3 SOAR provides RESTful operations to interface with Sophos XG Firewall version 2.

Sophos XG Firewall v2 is available for use in:

Connection

To connect to Sophos XG Firewall v2 from D3 SOAR, follow this part to collect the required information below:

Permission Requirements

Each endpoint in the Sophos XG Firewall v2 API requires a certain permission scope. The following are minimum required permissions necessary to execute the commands in this integration:

As Sophos XG Firewall v2 is using role-based access control (RBAC), the command permissions are inherited from the user account’s role. Users need to configure their user profile from the Sophos XG Firewall v2 console for each command in this integration.

READER NOTE

Sophos XG Firewall v2’s default user profiles are as follows:

• Administrator: Super administrator with full privileges. Profile of the default admin. Can create administrators with restricted or full privileges.

• Audit admin: Has read-write privileges to logs and reports.

• Crypto admin: Has read-write privileges to configure security certificates.

• HAProfile: Has read-only privileges to the auxiliary device, if high availability is configured.

• Security admin: Has read-write privileges to all features, except profiles, logs, and reports.

Refer to Device access and Add a device access profile for details on configuring user profiles.

Configuring Sophos XG Firewall v2 to Work with D3 SOAR

Allowing API Access to Administrators

1. Add an administrator profile.

   

   1. Navigate to the Profile menu item.

   2. Select the Device access tab.

   3. Click the Add button.

2. Configure the administrator profile.

   

   1. Name the profile.

   2. Select the Read-write radio option for the Objects row.

   3. Select the Read-write radio option for the Network row.

   4. Click the Save button.

3. Add an administrator.

   

   1. Navigate to the Authentication menu item.

   2. Select the Users tab.

   3. Click the Add button.

4. Configure the user.

   

   1. Enter a username.

   2. Enter a name.

   3. Select the Administrator option as the user type.

   4. Select the previously configured administrator profile.

   5. Enter and confirm the password.

   6. Enter the user's email address.

   7. Select the Open Group option as the group..

   8. Click the Save button.

5. Allow the previously configured user API access.

   

   1. Navigate to the Backup and firmware menu item.

   2. Select the API tab.

   3. Input the IP address from which API requests will originate (this should match the Server URL of the deployed Sophos XG Firewall instance, excluding the port number).

   4. Click the + button.

   5. Click the Apply button to save the configuration.

READER NOTE *

Ensure that the zone of the administrator's IP address has access to the web admin console. Users can do this on Administration > Device access using Local service ACL or Local service ACL exception rule.

Configuring D3 SOAR to Work with Sophos XG Firewall v2

1. Log in to D3 SOAR.

2. Find the Sophos XG Firewall v2 integration.

   

   1. Navigate to Configuration on the top header menu.

   2. Click on the Integration icon on the left sidebar.

   3. Type Sophos XG Firewall v2 in the search box to find the integration, then click it to select it.

   4. Click on the + Connection button on the right side of the Connections section. A new connection window will appear.

3. Configure the following fields to create a connection to Sophos XG Firewall v2.

   

   1. Connection Name: The desired name for the connection.

   2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.

   3. Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.

   4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.

   5. Description (Optional): Add a description for the connection.

   6. Tenant (Optional): When configuring the connection from a master tenant site, users have the option to choose the specific tenant sites to share the connection with. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.

      

   7. Active: Check the checkbox to ensure the connection is available for use.

   8. Configure User Permissions: Defines which users have access to the connection.

   9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.

      

      1. Input the Server URL of the Sophos XG Firewall v2 platform.
      2. Input the Username associated with the Sophos XG Firewall v2 platform.
      3. Input the Password associated with the Sophos XG Firewall v2 platform.

   10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.

   11. Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.

4. Test the connection.

   

   1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.

   2. Click OK to close the alert window.

   3. Click + Add to create and add the configured connection.

Commands

Sophos XG Firewall v2 includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Sophos XG Firewall v2 API, refer to the Sophos XG Firewall v2 API reference.

READER NOTE

Certain permissions are required for each command. Refer to the Permission Requirements and Configuring Sophos XG Firewall v2 to Work with D3 SOAR sections for details.

Block IPs

Blocks specified IP addresses by adding them to a designated IP host group. The host group must be referenced in a firewall rule configured to drop matching traffic.

READER NOTE

IP Host Group Name is a required parameter to run this command.

• Run the List IP Host Groups command to obtain the IP Host Group Name. IP Host Group Names can be found in the raw data at the path $.Response.IPHostGroup[*].Name.

Input

[ "***.***.***.***", "***.***.***.***" ] 

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

List Firewall Rules

Retrieves firewall rules from Sophos XG Firewall.

Input

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

List IP Hosts

Retrieves IP Host entries from Sophos XG Firewall.

Input

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

List URL Groups

Retrieves Web Filter URL Groups from Sophos XG Firewall.

Input

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

List Web Filter Policies

Retrieves Web Filter Policies from Sophos XG Firewall.

Input

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Test Connection

Allows users to perform a health check on an integration connection. Users can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.