audit_settings.yaml.example

# This file defines the expected settings for each audit rule.
#
# Local service ACL exception rule (System > Administration > Device Access > Local service ACL exception)
access_acl:
  hostgroups:
    - Internal ACL
    - External ACL
  services:
    - Ping
    - HTTPS
    - SSH
    - UserPortal
    - VPNPortal

# Central Management (System > Sophos Central)
central_management:
  FWBackup: BackupEnable
  JoinMethod: Manual
  UseCentralReporting: Enable
  CMStatus: Enable

# Device Access Profiles (System > Profiles > Device Access) 
device_access_profile:
  profiles:
    - Administrator
    - Audit Admin
    - Crypto Admin
    - HAProfile
    - HelpdeskAdmin
    - HelpdeskLimited
    - ReadOnly
    - Security Admin
# Check for enabled services on the WAN zone (enter [] for none)
admin_services:
  services: []
# Authentication servers (Configure > Authentication > Servers)
authen_servers:
  servers:
    - SophosFirewallSSO
# Threat Protection settings (Protect > Active threat response > Sophos X-Ops threat feeds)
threat_protection:
  state: Enable
  policy: Log and Drop
# Malware protection settings (Configure > System services > Malware Protection)
malware_protection:
  antivirus_engine: Sophos

# IPS Policies (Protect > Intrusion prevention > IPS policies) 
ips_policies:
  status: Enable
  policies:
    - DMZ TO LAN
    - DMZ TO WAN
    - General Policy
    - LAN TO DMZ
    - LAN TO WAN
    - WAN TO DMZ
    - WAN TO LAN
    - dmzpolicy
    - generalpolicy
    - lantowan_general
    - lantowan_strict
# Host groups - check host groups contain hosts listed here
host_groups:
  groups:
    - name: Isolated Subnets
      hosts:
        - NYC 172.16.4.0/24 Example_1
        - SFO 172.16.10.0/24 Example_2

# Syslog settings (Configure > System services > Log settings)
syslog:  
  - name: Local_Server
    LogSettings:
      ATP:
        ATPEvents: Enable
      AntiSpam:
        IMAP: Enable
        IMAPS: Enable
        POP3: Enable
        POPS: Enable
        SMTP: Enable
        SMTPS: Enable
      AntiVirus:
        FTP: Enable
        HTTP: Enable
        HTTPS: Enable
        IMAP: Enable
        IMAPS: Enable
        POP3: Enable
        POPS: Enable
        SMTP: Enable
        SMTPS: Enable
      ContentFiltering:
        ApplicationFilter: Enable
        SSLTLS: Enable
        WebContentPolicy: Enable
        WebFilter: Enable
      Events:
        AdminEvents: Enable
        AuthenticationEvents: Enable
        SystemEvents: Enable
      Heartbeat:
        EndpointStatus: Enable
      IPS:
        Anomaly: Enable
        Signatures: Enable
      SDWAN:
        Profile: Enable
        Route: Enable
      SecurityPolicy:
        BridgeACLs: Disable
        DoSAttack: Disable
        DroppedFragmentedTraffic: Disable
        DroppedICMPRedirectedPacket: Disable
        DroppedSourceRoutedPacket: Disable
        Heartbeat: Enable
        ICMPErrorMessage: Disable
        IP-MACPairFiltering: Disable
        IPSpoofPrevention: Disable
        InvalidTraffic: Disable
        LocalACLs: Disable
        MACFiltering: Disable
        PolicyRules: Enable
        ProtectedApplicationServer: Disable
        SSLVPNTunnel: Disable
      WebServerProtection:
        WAFEvents: Enable
      ZeroDayProtection:
        ZeroDayProtectionEvents: Enable

  - name: Central_Reporting
    LogSettings:
      ATP:
        ATPEvents: Enable
      AntiSpam:
        IMAP: Enable
        IMAPS: Enable
        POP3: Enable
        POPS: Enable
        SMTP: Enable
        SMTPS: Enable
      AntiVirus:
        FTP: Enable
        HTTP: Enable
        HTTPS: Enable
        IMAP: Enable
        IMAPS: Enable
        POP3: Enable
        POPS: Enable
        SMTP: Enable
        SMTPS: Enable
      ContentFiltering:
        ApplicationFilter: Enable
        SSLTLS: Enable
        WebContentPolicy: Enable
        WebFilter: Enable
      Events:
        AdminEvents: Enable
        AuthenticationEvents: Enable
        SystemEvents: Enable
      Heartbeat:
        EndpointStatus: Enable
      IPS:
        Anomaly: Enable
        Signatures: Enable
      SDWAN:
        Profile: Enable
        Route: Enable
        SLA: Enable
      SecurityPolicy:
        BridgeACLs: Enable
        DoSAttack: Enable
        DroppedFragmentedTraffic: Enable
        DroppedICMPRedirectedPacket: Enable
        DroppedSourceRoutedPacket: Enable
        Heartbeat: Enable
        ICMPErrorMessage: Enable
        IP-MACPairFiltering: Enable
        IPSpoofPrevention: Enable
        InvalidTraffic: Disable
        LocalACLs: Enable
        MACFiltering: Enable
        PolicyRules: Enable
        ProtectedApplicationServer: Enable
        SSLVPNTunnel: Enable
      SystemHealth:
        Usage: Enable
      WebServerProtection:
        WAFEvents: Enable
      Wireless:
        AccessPoints_SSID: Enable
      ZeroDayProtection:
        ZeroDayProtectionEvents: Enable
# Notification settings (System > Administration > Notification settings)
notifications:
  SenderAddress: "{{ firewall_hostname }}@example.com"
  AuthenticationRequired: Enable
  Port: "587"
  ConnectionSecurity: STARTTLS
  MailServer: mail.aol.com
  Recepient: alerts@xample.com
  Username: smtpuser
  ManagementInterface: 
# Notification List settings (Configure > System services > Notification list)
notification_list:
  SendEmail: Enable
  SendSnmp: Enable
  SignInEmail: Disable
  SignInSnmp: Disable
  TooManyLoginEmail: Disable
  TooManyLoginSnmp: Disable
  InterfaceEmail: Enable
  InterfaceSnmp: Enable
  ApplianceUnpluggedEmail: Enable
  ApplianceUnpluggedSnmp: Enable
  CriticalEmail: Disable
  CriticalSnmp: Disable
  MajorEmail: Disable
  MajorSnmp: Disable
  ModerateEmail: Disable
  ModerateSnmp: Disable
  MinorEmail: Disable
  MinorSnmp: Disable
  WarningEmail: Disable
  WarningSnmp: Disable
  AlertATPEmail: Disable
  AlertATPSnmp: Disable
  DropATPEmail: Disable
  DropATPSnmp: Disable
  ConfDiskExdEmail: Enable
  ConfDiskExdSnmp: Disable
  SigDiskExdEmail: Enable
  SigDiskExdSnmp: Disable
  ReportDiskExdEmail: Enable
  ReportDiskExdSnmp: Disable
  FirmwareReadyEmail: Enable
  FirmwareReadySnmp: Disable
  FirmwareInstalledEmail: Enable
  FirmwareInstalledSnmp: Disable
  FirmwareInstalledFailedEmail: Enable
  FirmwareInstalledFailedSnmp: Enable
  WebCatFailEmail: Disable
  WebCatFailSnmp: Disable
  IPSSigFailEmail: Enable
  IPSSigFailSnmp: Disable
  AVFailEmail: Enable
  AVFailSnmp: Disable
  SystemStartEmail: Disable
  SystemStartSnmp: Disable
  RedDownEmail: Enable
  RedDownSnmp: Disable
  RedUpgradeFailEmail: Disable
  RedUpgradeFailSnmp: Disable
  APOfflineEmail: Disable
  APOfflineSnmp: Disable
  APUpgradeFailEmail: Disable
  APUpgradeFailSnmp: Disable
  IPsecUPEmail: Disable
  IPsecUPSnmp: Disable
  IPsecDownEmail: Disable
  IPsecDownSnmp: Disable
  HighCpuEmail: Disable
  HighCpuSnmp: Enable
  GwUnrcblEmail: Disable
  GwUnrcblSnmp: Disable
  HttpVirusAlertEmail: Disable
  HttpVirusAlertSnmp: Disable
  FtpVirusAlertEmail: Disable
  FtpVirusAlertSnmp: Disable
  SmtpVirusAlertEmail: Disable
  SmtpVirusAlertSnmp: Disable
  Pop3VirusAlertEmail: Disable
  Pop3VirusAlertSnmp: Disable
  Imap4VirusAlertEmail: Disable
  Imap4VirusAlertSnmp: Disable
  IPSecFailoverFailbackEmail: Disable
  IPSecFailoverFailbackSnmp: Disable
  SSLVPNUPEmail: Disable
  SSLVPNUPSnmp: Disable
  SSLVPNDownEmail: Disable
  SSLVPNDownSnmp: Disable
  RedDeauthorizeEmail: Enable
  RedDeauthorizeSnmp: Disable
  RedUnlockCodeEmail: Enable
  RedUnlockCodeSnmp: Disable

# Scheduled Backup Settings (System > Backup & firmware > Backup & restore)
scheduled_backup:
  BackupMode: Mail  # FTP/Mail/Local
  FtpPath:
  Username:
  FTPServer:
  EmailAddress: alerts@example.com
  BackupFrequency: Weekly
  Date:
  Day: Sunday
  Hour: "23"
  Minute: "00"

# Reports retention (Monitory & Analyze > Reports > Report Settings > Data management)
# reports_retention:
  
# CA Certificate (System > Administration > Admin and user settings)
certificate:
  WebAdminSettings:
    Certificate: Webadmin-CA
    HTTPSport: "4444"
    UserPortalHTTPSPort: "4443"
    VPNPortalHTTPSPort: "443"
    PortalRedirectMode: ip
    PortalCustomHostname: 

# Login Security (System > Administration > Admin and user settings)
login_security:
  LoginSecurity:
    LogoutSession: Disable
    BlockLogin: Enable
    BlockLoginSettings:
      UnsucccessfulAttempt: "3"
      Duration: "30"
      ForMinutes: "3"
  PasswordComplexitySettings:
    PasswordComplexityCheck: Disable
    PasswordComplexity:
      MinimumPasswordLength: Disable
      IncludeSpecialCharacter: Disable
  LoginDisclaimer: Disable
  DefaultConfigurationLanguage: English

# DNS Servers (Configure > Network > DNS)
dns_servers:
  - 4.2.2.1
  - 4.2.2.2

# SNMPv3 (System > Administration > SNMP)
snmpv3:
  Username: snmpv3_user
  AcceptQueries: Enable
  SendTraps: Enable
  AuthorizedHosts: 
    - 10.1.100.101
    - 10.1.100.102

# Time Settings (System > Administration > Time)
time:
  timezone: Europe/Dublin

# SMTP Protection Settings (Protect > Email > General Settings)
smtp_protect:
  mta_mode: "ON"