Update Sophos Endpoint Data Connector via CCP

[joanabmartins]

Change(s):

• Updated Sophos endpoint data connector with ccp option and parser

Reason for Change(s):

• Data Collector API is going to be deprecated
• CCP data connector is an alternative to the function connector

Version Updated:
N/A

Testing Completed:
Need help ; connector and parser were tested, but I haven't tested them after packaging the solution. There was 1 error after packaging, related with IDs. I'm available for further explanation ms alias: joamar

Checked that the validations are passing and have addressed any issues that are present:
No

[v-prasadboke]

Hello @joanabmartins, Thanks for raising this PR. This PR will be investigated and we will update you about the same before 02 February, 2024.
Until then please create a custom table named as SophosEPEvents_CL at location .script/tests/KqlvalidationsTests/CustomTables

[joanabmartins]

@v-prasadboke thank you. I've just added both tables SophosEPEvents_CL and SophosEPAlerts_CL

[v-prasadboke]

Hello @joanabmartins, Trying to resolve validation errors. Will get back to you by 06 February, 2024.

[v-prasadboke]

Hello @joanabmartins, create a custom table schema with name SophosEPEvent.json at the location
.script/tests/KqlvalidationsTests/CustomTables

[joanabmartins]

Hi @v-prasadboke I'm not sure if I understand what you are asking me. I've already committed both custom tables to that location 0185777#diff-355c3a73d521e1aaca14f35fcfb04a9079449d3de241604e048592781958d3c1 per your previous ask.
do you want me to remove the _CL is that it?

[v-prasadboke]

We need one custom table named after parser name.
While we use parser in detections or any other content, for this we need to have schema too.

[joanabmartins]

@v-prasadboke thank you for clarifying! I just added that table (i'm sorry I should have given a better name for the commit )

[v-prasadboke]

Hello @joanabmartins, can you provide sample data to test the content of the solution.

[joanabmartins]

@v-prasadboke what do you mean by sample data? sample logs? or credentials so sign-in to sophos to test the connector? I'm fine either way. Should I email that to you? Thank you

[v-prasadboke]

you can share the credentials and sample log over email
sample log should be in csv or json format needed for testing. Eventually will be ingesting the data for parser testing

[joanabmartins]

@v-prasadboke great, i just shared both through email. Thank you

[v-prasadboke]

Hello @joanabmartins, Thanks for sharing the credentials and sample data. I'll test the content and come back to you by 14 February, 2024.

[v-prasadboke]

Hello @joanabmartins, we are facing issue while running the Data connector. Connect button doesn't appear on the connector page. We are trying to resolve the issue

[joanabmartins]

By mistake I included the workday connector PR in this one, but we have corrected it, that is why there is a force-pushed. It is all good now :)

[v-prasadboke]

Thanks @joanabmartins for the update. We will get back to you regarding Data connector button issue.