Sophos

Prerequisites

• A Sophos firewall that supports external blocklist ingestion.
• A Trusteed account with access to the Noise-Aware IP blocklist feed.

Setup Steps

1. Log into your Trusteed Console.
2. Navigate to Integrations → Firewalls → Sophos.
3. Click Connect under the Sophos logo and assign a unique integration name.
4. Copy the credentials (displayed once) for configuring your Sophos device.
5. In your Sophos Firewall, add a new blocklist feed using the Trusteed URL:

https://<username>:<password>@api.trusteed.io/v1/integrations/<integration_id>/content


1. Save and activate the feed.
2. Configure a firewall policy to block all traffic coming from the blocklist.

Blocklist Format Example

Plain text format, one IP per line:

192.168.38.187
192.168.38.186


Outcome

• Known attacker IPs are blocked automatically at the Sophos firewall.
• SIEM and SOAR pipelines receive fewer false positives.
• Analysts focus on attacker-linked signals instead of background noise.

Next Steps

• Explore Trusteed’s Blocklist Catalog to add more feeds.
• Extend integrations by combining Sophos enforcement with SIEM/SOAR logging.
• Automate response workflows with Trusteed’s enriched intelligence.