Unofficial Sophos Fusion XDR and SIEM Library
Unofficial project, not from Sophos. This is a personal project by an individual. It is not an official Sophos product and it is not built, endorsed, supported, or warranted by Sophos. Raise problems as issues on this repository, not with Sophos support. Report a security problem privately, as SECURITY.md explains.
A library of parsers, playbooks and connectors for Sophos Fusion that people share, with Parser Studio, a page that helps you write custom parsers and test them in your browser. It has three sections:
- Parsers: custom parsers for Sophos Next-Gen SIEM (Sophos NG-SIEM), each with synthetic samples and the emulator's expected output. Anyone can use them, test them against their own logs, fork them, and add to them.
- Playbooks: Sophos Fusion playbook templates to import, each with its setup steps, risk tier, MDR note and rollback. The ones that change tickets, devices or user accounts ship with dry run on. The IT Glue, NinjaOne, Rewst, Slack and Teams playbooks have no dry run: they only post a message, add a case comment or send case fields to Rewst. The owner reviews every one.
- Connectors: custom connectors for products that have no connector from Sophos, or for functions Sophos's connector lacks, which the playbooks call. Each one calls only hosts its vendor documents.
Open the library at https://aaronjacobs000.github.io/sophos-xdr-siem-library/ and Parser Studio at https://aaronjacobs000.github.io/sophos-xdr-siem-library/#/build/sample
This repo was called sophos-ngsiem-parser-studio until October 2026. Links to the old site redirect here, and the old repo's page links here.
Parser Studio
- Sample: paste or drop log lines. The page finds the syslog header and the body format (JSON, CEF, LEEF, key=value, delimited or plain text), the key that splits event types, and a confirm string. It suggests a parent parser with one child per event type, or a single standalone parser.
- Map fields: each source key gets a parser field for the schema you pick, from a dictionary of common key names and the shape of each value. You change any mapping, map source values to enum names, add fixed values, and send the rest to
event_metadata. Plain-text logs get a capture pattern with named groups that you can edit.
- Test and export: the page writes the scripts and runs every sample through an emulator of the parser language. You see the extractor path and the parsed record for each line, and a lint report. Edit a script and the results update. Then copy the scripts into Sophos Fusion, download a test pack, or share the parsers to the library.
The lint checks syntax and directives, documented functions and their arguments, every $ field against the destination schema, sub-fields against their types, enum values, regex patterns that Go's RE2 engine rejects, DATETIME layouts, and confirm strings that overlap a parser in the library. Each schema page on docs.sophos.com is linked from the map step.
Mapping is rules only. There is no AI service and no backend.
Privacy
Everything runs in the browser tab. Your samples are never uploaded and never written to browser storage. The page counts visits with GoatCounter, an open-source counter that uses no cookies. It sends the route you open, such as /parsers/vendor/product, and on the first page the site that linked you there, and nothing you type or paste. GoatCounter works out the country from the IP address and doesn't keep the address or browser details. The page's content security policy only lets it fetch from the site itself, to read the library, and send those counts to GoatCounter. The site never connects to a Sophos Fusion tenant.
The emulator and its limits
There is no public Sophos parser engine or parser API, so the emulator follows the custom parser docs: statements, capture patterns, JSONPath, every documented function, parent and child routing, SANITIZE_ALL and TRIM_ALL. Where the docs are silent, it does what the Sophos engine did in a lab tenant. For example, enum fields take names in any case or numbers, sub-fields such as fileHash$.sha1$ work, the root parser sets sensor_type, takes sensor_id and the event time from a plain BSD syslog header, and Run Test rejects a parser that reads a variable before a statement sets it, even in an IF branch that isn't taken. The lint marks the few behaviors that haven't been checked as inferred. Sophos Fusion won't save a parser with *= anywhere in its code, a comment or a regex included, though Run Test accepts it, so the lint flags it as an error. It saves a !PARENT line, which the docs use to extend a global parser, only with Set Global Parent in Parser Script turned on, so the lint warns about one.
The emulator handles the syslog header the way Run Test does: it takes a plain BSD header such as Oct 14 01:02:03 host off message. A line that starts with a <PRI> such as <134>, an RFC 5424 header or an ISO time keeps its header: message is the whole line, there is no sensor_id, and the event time is the ingest time. eventTimeUsec$ already holds it, in microseconds and to the whole second, when the parser starts. Whether ingest takes the <PRI> off first hasn't been checked.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
