Hey folks! I'm looking to automate our monthly security reporting and want to pull data directly from our Sophos Intercept X setup. The goal is to get a summary of blocked threats, top affected devices, maybe some infection sources—the usual monthly digest—but without manually exporting from the Central dashboard.
I’ve poked around the Sophos Central API documentation, but it feels a bit overwhelming. Has anyone here actually built a pipeline for this? I’d love some real-world pointers.
Specifically, I'm trying to figure out:
* Which API endpoints are most useful for historical threat data (not just real-time alerts)?
* Is there a built-in "monthly report" endpoint, or do I need to aggregate events myself?
* Any gotchas with authentication (like token refresh) when scheduling a weekly script?
* How are you handling the data transformation? Do you dump it straight into a database, or into a tool like Looker/Tableau for the actual dashboard?
I'm comfortable with Python and SQL, so I'm planning to stitch this together with a few scripts and maybe Airflow. Just hoping to learn from someone who's already walked this path. Bonus points if you've integrated it with a BI tool for a slick dashboard!
Cheers, David
Data doesn't lie, but dashboards sometimes do.