Sophos integration
Pull complete endpoint inventory, user directories, and security alerts from Sophos Central to power automated incident response and compliance workflows.
What it connects
- Complete managed device inventory with OS, health status, and last-seen timestamps.
- User and group membership data from Sophos directory for access control alignment.
- Security alerts and threat detections with severity levels and affected endpoints.
- Endpoint protection status including tamper protection and installed product versions.
What it automates
- Isolate compromised endpoints from the network to contain threats.
- Trigger full endpoint scans when security incidents require deep investigation.
- Remove users from groups or remove endpoints from device groups for access changes.
- Acknowledge alerts to mark them as reviewed during incident triage.
In practice
- When Sophos detects ransomware on a workstation, STLabs auto-opens a P1 incident, isolates the endpoint, and pages your security team with full context.
- STLabs aggregates tamper protection alerts across your fleet and auto-creates remediation tickets for devices where protection was disabled.
- A user loses access to a legitimate site due to Sophos web control. STLabs pulls the policy logs and auto-submits an exception request for admin approval.
- Offboard a contractor. STLabs removes them from their assigned user groups and removes their devices from shared device groups in seconds.
