Sophos Firewall logs not showing in Wazuh

grep -e '^.*device="' -e 'device_name="' /var/ossec/logs/archives/archives.log | tail -n 3

Why it happens

The stock decoder in ruleset/decoders/0510-sophos_fw_decoders.xml on 4.14.7 is anchored on the legacy start of line:

<prematch>^device="\w*"\s+date=\d+-\d+-\d+\s+time=</prematch>

Sophos's syslog guide documents both layouts: the legacy one (device, date, time, timezone, device_id, status) and the Central Reporting one (device_name, ISO timestamp, device_model, device_serial_id, log_subtype, no status). The stock rules (0705-sophos_fw_rules.xml, 70020–) key on the decoded status, so a Central Reporting line has neither the decoder nor the field the rules need.

Fix

Option 1: send the legacy layout

Sophos's syslog guide calls the legacy layout Device standard and the new one Central reporting. If your firewall's syslog server settings let you pick the format, pick the device-standard one and the stock decoder and rules apply as they are. Other tools reading the same stream may expect the new layout; check before switching.

Option 2: decode the Central Reporting layout

Save as /var/ossec/etc/decoders/sophos_crf_decoders.xml:

<!-- Sophos Firewall, Central Reporting syslog format (device_name="..." timestamp="..."). ATK, tested on Wazuh 4.14.7. -->
<decoder name="sophos-fw-crf">
  <prematch>^device_name="\S+" timestamp="</prematch>
</decoder>

<decoder name="sophos-fw-crf-fields">
  <parent>sophos-fw-crf</parent>
  <regex type="pcre2">log_type="([^"]*)" log_component="([^"]*)" log_subtype="([^"]*)"</regex>
  <order>log_type, log_component, log_subtype</order>
</decoder>

<decoder name="sophos-fw-crf-fields">
  <parent>sophos-fw-crf</parent>
  <regex type="pcre2">\bfw_rule_id="([^"]*)"</regex>
  <order>fw_rule_id</order>
</decoder>

<decoder name="sophos-fw-crf-fields">
  <parent>sophos-fw-crf</parent>
  <regex type="pcre2">\bsrc_ip="([^"]*)"</regex>
  <order>srcip</order>
</decoder>

<decoder name="sophos-fw-crf-fields">
  <parent>sophos-fw-crf</parent>
  <regex type="pcre2">\bdst_ip="([^"]*)"</regex>
  <order>dstip</order>
</decoder>

<decoder name="sophos-fw-crf-fields">
  <parent>sophos-fw-crf</parent>
  <regex type="pcre2">\bprotocol="([^"]*)"</regex>
  <order>protocol</order>
</decoder>

<decoder name="sophos-fw-crf-fields">
  <parent>sophos-fw-crf</parent>
  <regex type="pcre2">\bsrc_port="([^"]*)"</regex>
  <order>srcport</order>
</decoder>

<decoder name="sophos-fw-crf-fields">
  <parent>sophos-fw-crf</parent>
  <regex type="pcre2">\bdst_port="([^"]*)"</regex>
  <order>dstport</order>
</decoder>

Save as /var/ossec/etc/rules/sophos_crf_rules.xml (IDs in the custom range; change them if they collide):

<group name="sophos,firewall,">
  <rule id="100320" level="0">
    <decoded_as>sophos-fw-crf</decoded_as>
    <description>Sophos Firewall (Central Reporting format) event.</description>
  </rule>

  <rule id="100321" level="5">
    <if_sid>100320</if_sid>
    <field name="log_type">^Firewall$</field>
    <field name="log_subtype">^Denied$</field>
    <description>Sophos Firewall: traffic denied from $(srcip) to $(dstip):$(dstport).</description>
    <group>firewall_block,</group>
  </rule>

  <rule id="100322" level="3">
    <if_sid>100320</if_sid>
    <field name="log_type">^Firewall$</field>
    <field name="log_subtype">^Allowed$</field>
    <description>Sophos Firewall: traffic allowed from $(srcip) to $(dstip):$(dstport).</description>
  </rule>

  <rule id="100323" level="10" frequency="18" timeframe="45" ignore="240">
    <if_matched_sid>100321</if_matched_sid>
    <same_source_ip />
    <description>Sophos Firewall: multiple denied connections from $(srcip).</description>
    <group>firewall_block,</group>
  </rule>
</group>

Then /var/ossec/bin/wazuh-analysisd -t and restart. The source address is written as srcip (not src_ip as in the stock decoder), so <same_source_ip> correlation and the firewall-drop active response can use it.

What we measured with Option 2

wazuh-analysisd -t: no warnings, no 7617/7619.