I’ve been looking at the Sophos XGS platform for a while now, specifically at how it handles dynamic external data like IP lists. The marketing materials and even some community posts make it sound like a seamless, modern firewall feature. After digging into the actual implementation, I’m finding the reality is a lot more cumbersome and locked down than it should be.
Here’s my core issue: I need to create a firewall rule that references a list of dynamic IPs—say, a published block list from a trusted security feed that updates daily. The goal is to have an alias or a list object in the XGS that can be updated via a scheduled task, pulling from a public URL, without manual intervention every single day. The native “Hosts and Networks” objects seem overwhelmingly static. I’ve seen other vendors handle this with a simple scheduled script that fetches and updates a group.
I’ve poked around the CLI and the GUI, and the options seem to be either manually uploading a CSV periodically (which defeats the purpose) or writing a custom script that uses the REST API to inject the new list. The latter introduces a whole new layer of complexity, dependency on API stability, and a potential point of failure I now have to maintain and secure. Why isn’t this a built-in, first-class function in a firewall at this price point? It feels like a deliberate omission to push you towards their paid threat intelligence subscriptions.
So my question isn’t just about the technical steps—I can probably cobble together a Python script with the API. What I want to know is whether anyone has found a native, supported method within Sophos XGS itself to do this that I’ve missed. If the answer is truly “you must build and host your own automation,” then what are the gotchas? Has anyone’s custom update script broken after a firmware update? Are there hidden limits on the number of dynamic entries? What’s the real total cost of ownership when you have to become a part-time developer to automate a basic security hygiene task?
Skeptic by default