Sophos Intercept X
Connect Sophos Intercept X to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Sophos Intercept X to collect endpoint detection & response evidence with automated compliance tests, switched on per workspace.
| Category | Endpoint Detection & Response |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Sophos Intercept X's guide | developer.sophos.com |
Connect with an API token
-
In Sophos Intercept X:
- In Sophos Central, click the Global Settings icon, go to Access Control, and click API Credentials.
- Click Add Credential and give the credential a name (such as Safeguard) and a description.
- Choose the role Service Principal Read-Only.
- Click Add. This generates the credential with a Client ID and a Client Secret.
- Copy the Client ID and Client Secret now.
Where to find the other values:
- Client ID: Shown with the new credential after you click Add, on the API Credentials page.
Sophos Intercept X shows the secret only once, so copy it before you leave the page.
Sophos: 'You can only see the Client Secret once.' Service Principal Read-Only lets the credential view all information in the account.
Source: docs.sophos.com, developer.sophos.com, checked 2026-10-07.
The permissions Safeguard needs:
Service Principal Read-only. -
On Compliance › Connectors, open Sophos Intercept X, click Connect, choose API token and fill in:
Field What to enter Client ID Required. Client secret Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Sophos Intercept X and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.8, CC7.2, CC7.3, CC7.4 | 9 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.5.26, A.6.5, A.8.1, A.8.7, A.8.16 | 9 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6) | 9 |
| PCI DSS | Automated tests | 5.2.1, 5.3.1, 5.3.5, 7.2.4, 8.2.5, 12.10.1 | 9 |
| NIST CSF 2.0 | Automated tests | DE.AE-02, DE.CM-09, PR.AA-01, PR.AA-05, PR.PS-01, RS.MI-02 | 9 |
These tests are switched on per workspace by the Safeguard team.
Related
- Endpoint Detection & Response connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks