Sophos Taegis

Source: Sophos Taegis. Enterprise tier. The connector talks to the Secureworks Taegis XDR GraphQL gateway for your region. It is not Sophos Central; a source saved with Sophos Central credentials fails with Taegis rejected the client credentials until Taegis ones are entered.

Client credentials

Create the credential in Taegis under Tenant Settings > Manage API Credentials and copy its client ID and client secret.
CICADA exchanges them for a token at POST <gateway>/auth/api/v2/auth/token using HTTP Basic authentication, then sends every query to POST <gateway>/graphql with that token. The token is renewed five minutes before it expires.

The source form

Field	Notes
Client ID, Client Secret	Required.
Region	Picks the gateway. Default `us1`.
Tenant ID (optional)	Only for MSSP credentials that cover more than one tenant. Sent as the `X-Tenant-Context` header on every query.
Base URL override (optional)	For a region not in the list or a private gateway. When set it wins over Region.

Region gateways

Region	Gateway
`us1`	`https://api.ctpx.secureworks.com`
`us2`	`https://api.delta.taegis.secureworks.com`
`us3`	`https://api.foxtrot.taegis.secureworks.com`
`eu1`	`https://api.echo.taegis.secureworks.com`
`eu2`	`https://api.golf.taegis.secureworks.com`

Allow outbound HTTPS from the appliance to the one gateway you use. These hosts are not yet on Network Requirements; take them from this table.

What is collected

Alerts, through the alertsServiceSearch query with a CQL time window for the investigation's collection period, 100 per page: title, description, severity, confidence, status, resolution, sensor types, ATT&CK technique IDs and the entities on the alert.
Endpoint assets, through searchAssetsV2, when an analyst or the AI assistant names a host by hostname or IP address. Up to 25 matches.
There is no raw event search; the connector's author found no such call in the Taegis API.

The connection test runs a one-alert query (FROM alert EARLIEST=-1d). A 401 answers Taegis rejected the token (HTTP 401). Re-enter the credentials.

Isolation reads "Unconfirmed"

Isolate Device sends the isolateAsset mutation with the asset ID and a reason. Taegis answers with the asset record, whose status field is the record state (active, deleted, unhealthy), not whether the host is isolated. Isolation state lives on the asset's endpoint information, which CICADA does not read back. So CICADA records the action as Unconfirmed with the message Isolation requested for Taegis asset <id> (<hostname>); Taegis does not report confirmation. Check the Taegis console: a disconnected agent shows Isolation Pending until it reconnects. Unconfirmed is not a failure; it means CICADA will not claim something it has not seen.

Lifting isolation is not offered for Taegis. The connector's author found no restore call in the API. Restore the host from the Taegis console: Endpoint Agents → Summary → Actions → Restore Host. The Taegis API has no restore call. The queue does not show that instruction on the completed action; it appears only here and in the dry-run message.