Description

Sophos Central Node for n8n


Community node for the Sophos Central Firewall Management API — built for MSPs and Organizations.

> Note: This node currently focuses on Sophos Firewalls only, as that is the hardware I have access to for development and testing. Sophos Central supports additional products (Endpoints, Email, etc.) — contributions to expand the nodes are welcome!
>
> Region Testing: This node has been tested with US data regions (api-us01, api-us03). Non-US regions should work via the dynamic region routing, but have not been verified.

—

Features

| Feature | Description |
| ——————— | —————————————————————– |
| Multi-Tenant | Execute operations across all managed tenants in a single run |
| Dynamic Regions | Auto-routes to correct data region (api-us01, api-eu01, etc.) |
| Firewall Mgmt | List, retrieve, and monitor firewall status |
| Firmware Ops | Check compliance, schedule upgrades, cancel pending |
| Alerting | Get alerts, acknowledge, resolve — with “Only Actionable” filter |
| Health Checks | Retrieve connection and managing status |
| Partner APIs | Billing usage, admin management, roles (MSP only) |
| Tenant Management | Create, get, list tenant organizations (MSP only) |
| Diagnostics | Confirm account scope, regions, tenant access, and licensing mode |

—

Installation

Community Nodes (Recommended)

1. In n8n, go to Settings → Community Nodes → Install
2. Enter: @joshuanode/n8n-nodes-sophos-central
3. Click Install

Manual Installation

npm install @joshuanode/n8n-nodes-sophos-central

—

Credentials

Partner (MSP)

For managing multiple tenant accounts:

| Field | Value |
| —————— | ————————————————————— |
| Client ID & Secret | From Sophos Partner Portal |
| Account Type | Partner |
| Tenant ID | Leave empty |

> Tip: Leave the Tenant field empty in operations to aggregate data from all managed tenants.
>
> Licensing note: Sophos currently rejects its documented partner-scoped firewall-licensing request. This node automatically uses tenant-scoped licensing calls for each managed tenant instead.

Organization

For managing a single account:

| Field | Value |
| —————— | —————————– |
| Client ID & Secret | From Sophos Central Admin |
| Account Type | Organization |
| Tenant ID | Your Tenant API ID (required) |

—

Operations

Firewall

| Operation | Description |
| ———— | —————————————————- |
| Get | Retrieve a specific firewall |
| Get Many | List firewalls with filters (Name, Serial, Firmware) |

Firmware

| Operation | Description |
| —————— | ——————————————– |
| Check Upgrades | Check current version and available upgrades |
| Upgrade | Schedule or trigger immediate upgrade |
| Cancel Upgrade | Cancel a scheduled upgrade |

Firewall Groups

| Operation | Description |
| ——————- | —————————- |
| Get | Retrieve a firewall group |
| Get Many | List all groups |
| Get Sync Status | Check synchronization status |

Alerts

| Operation | Description |
| —————— | ————————————————————- |
| Get | Retrieve a specific alert |
| Get Many | List alerts with filters (Severity, Product, Only Actionable) |
| Perform Action | Acknowledge or Resolve (supports batch) |

Health

| Operation | Description |
| ————– | —————————– |
| Get Health | Retrieve status for firewalls |

Licensing

| Operation | Description |
| — | — |
| Get Firewall License by Serial Number | Retrieve a firewall subscription by serial number |
| Get Many Firewall Licenses | Retrieve firewall subscriptions across managed tenants or a single organization |
| Get Many Tenant Licenses | Retrieve tenant product licenses; Partner credentials are automatically expanded across tenants |

Diagnostic

| Operation | Description |
| — | — |
| Connection Check | Returns Sophos identity type, Partner ID, tenant count, regions, and active licensing mode |

Organization (Partner Only)

| Operation | Description |
| ———— | ————————————- |
| Create | Provision a new tenant organization |
| Get | Retrieve tenant details by ID |
| Get Many | List all managed tenant organizations |

Partner (Partner Only)

| Operation | Description |
| ————————– | —————————————- |
| Create Admin | Create a new partner administrator |
| Delete Role Assignment | Remove a role assignment from an admin |
| Get Admin | Get a specific partner administrator |
| Get Billing Usage | Monthly usage report; months with no Sophos report return an empty result |
| Get Many Admins | List all partner administrators |
| Get Many Roles | List available roles and permission sets |
| Get Role Assignments | Get all role assignments for an admin |

—

Architecture

┌─────────────┐     ┌──────────────┐     ┌─────────────────┐
│   n8n       │ ──▶ │  This Node   │ ──▶ │  Sophos Central │
│  Workflow   │     │  (OAuth2)    │     │  API v1         │
└─────────────┘     └──────────────┘     └─────────────────┘
                           │
                    ┌──────┴──────┐
                    ▼             ▼
              Token Cache    Region Cache
              (5 min TTL)    (per tenant)

• Automatic Region Routing: Caches tenant-to-region mapping
• Token Caching: Reuses OAuth tokens until shortly before expiry
• Transient API Retries: Retries rate-limit and server errors with exponential backoff

—

Development

Install dependencies
npm install
Build
npm run build
Lint
npm run lint

—

License

MIT