Key fields from this data for this process are: The fields will be gathered using the Sophos Central get endpoint API. We can gather an inventory list of devices using the Sophos Central API.

We also need to establish the current devices in Sophos Central. Important fields from this data source are:

You will need to monitor the latest changes in the Disabled OU or equivalent location dependent on how your organization manages retired devices and rebuild processes. For a quick overview, below is a process diagram we have in place.įirstly, and most importantly, we need a source of truth for devices, and for most organizations this is AD. To answer these questions, I will cover the basic components of our process as a template for you to implement into your own environment and processes.

What tools do I have to assist with this process?.

What happens if an active machine is deleted automatically?.

What data will I need to collect to help determine whether I can delete a device?.The second option still uses the Sophos Central API to gather device information, but with the added benefit of using a Security Information and Event Management (SIEM) and Security Automation and Orchestration (SOAR) tool to make it as automated as possible from end to end.įor the second option we need to answer a few questions: You can create a script which will delete devices using the Sophos Central API.Īt the end of this blog post there are two demo scripts to allow you to gather inactive devices and then delete them. The first is somewhat a manual process using the Sophos Central API to gather device information and manually cross reference those devices against your source of devices. If there are many devices in need of deleting, we do not want to manually delete these through the UI of Sophos Central. This means there is currently no native method to clear old devices from Sophos Central automatically. So why do I need to do this?Ĭurrently the Sophos Central Active Directory (AD) Sync Utility supports synchronizing AD users and user groups, but not devices and device groups. Although, I’m sure for many of us out there, there’s a device that may have slipped through the net and is lying dormant in Sophos Central. Perhaps your tenant is looking spick and span and is a model deployment. Whatever the reason, you may already have a robust process in place for dealing with such devices. This could be due to a multitude of reasons. The number of devices managed in your Sophos Central will increase over time, and, as your estate evolves, some devices may not have a recent last activity date.

Fivem gun sound pack