Hey everyone,
I've been lurking for a while, but this is my first post. I work for a mid-sized company, and we recently made the switch from a Check Point firewall (an older 3000 series appliance) to a Sophos XGS 2700. My team handles the data side of things, but I often get pulled into networking discussions because of the analytics dashboards I build.
The main reason for the switch was cost at renewal time, but my boss also heard Sophos Central was more intuitive. Now that I've been in the Web Admin for a few weeks, I'm not totally convinced. It's *different*, but is it *easier*?
For example, creating a simple firewall rule in Check Point felt like a lot of steps in SmartConsole, but I knew where everything was. With Sophos, I find myself hunting for certain settings. The dashboard is cleaner, but maybe that's because some things are hidden?
Here's a specific thing I'm trying to do that feels clunky: I need to create a report on blocked outbound connection attempts by user group. In Check Point, I could usually trace this through logs and build a query. With Sophos, the logging seems just as detailed, but the path to filter and export feels longer. Is there a shortcut I'm missing?
```sql
-- This is the kind of logic I'm used to applying to log data.
-- Not actual Sophos SQL, but conceptually what I need.
SELECT user, destination_ip, COUNT(*) as block_count
FROM firewall_logs
WHERE action = 'blocked' AND direction = 'outbound'
AND timestamp > DATEADD(day, -7, GETDATE())
GROUP BY user, destination_ip
ORDER BY block_count DESC;
```
Has anyone else made this specific migration? For those managing the XGS day-to-day:
1. Did you find the learning curve steep coming from another vendor?
2. Are the built-in reports in Sophos Central good enough, or do you end up exporting logs to another analytics tool?
3. Any "aha" moments where something in Sophos was genuinely simpler than in Check Point?
I'm hoping it's just my unfamiliarity. The hardware itself seems solid, and throughput is great. Just trying to wrap my head around the management side.