# Automating Sophos Central Agent Policies Integration via Python

**URL:** https://discuss.elastic.co/t/automating-sophos-central-agent-policies-integration-via-python/351349
**Category:** Elastic Agent
**Created:** [January 18, 2024, 10:25am UTC](https://discuss.elastic.co/t/automating-sophos-central-agent-policies-integration-via-python/351349 "2024-01-18T10:25:55Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![bl4ck-m33k4t](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bl4ck-m33k4t/32/130906_2.png) [@bl4ck-m33k4t](https://discuss.elastic.co/u/bl4ck-m33k4t)
#### Post date: [January 18, 2024, 10:25am UTC](https://discuss.elastic.co/t/automating-sophos-central-agent-policies-integration-via-python/351349/1 "2024-01-18T10:25:55Z")

</div>

Hi everyone,

I'm currently working on automating the deployment of Sophos Central Agent policies using Python. My goal is to create policies and add integrations programmatically. However, I'm facing challenges with the structure of the API request for adding Sophos central policies integration.

**Issue:** The API expects a complex structure of parameters, and despite multiple attempts with various structures, I consistently encounter errors. The primary issue seems to revolve around the `inputs` parameter and the formatting of the `client_id` within the `config` object.

**Attempts:** I've tried different configurations for the request body, especially changing the format of `inputs` between an object and an array, and ensuring that `client_id` is a string. Despite these efforts, I keep running into the following error:

```auto
{
    "statusCode": 400,
    "error": "Bad Request",
    "message": "[request body]: types that failed validation:
        - [request body.0.inputs.0.config.client_id]: could not parse object value from json input
        - [request body.1.inputs]: expected value of type [object] but got [Array]"
}

```

**Request Structure:** Here's an outline of my current request structure :

```auto
        data = {
            "name": "poc_sophos",
            "policy_id": policy_id,
            "package": {
                "name": "sophos_central",
                "version": "1.13.0"
            },
            "namespace": "sophos_poc",
            "inputs": [{
                "type": "sophos_central-httpjson",
                "enabled": True,
                "config": {
                    "client_id": str(client_id),
                    "client_secret": str(client_secret),
                    "tenant_id": str(tenant_id),
                    "request_url": str(request_url),
                    "token_url": str(token_url),
                    "proxy_url": None,
                    "ssl": None
                },
                "streams": [
                    {
                        "id": "sophos_central.alert",
                        "enabled": True,
                        "data": {
                            "http_client_timeout": "3000",
                            "interval": "60",
                            "initial_interval": "60",
                            "batch_size": 100,
                            "preserve_original_event": True,
                            "preserve_duplicate_custom_fields": True,
                            "tags": ["tag1", "tag2"]
                        }
                    },
                    {
                        "id": "sophos_central.event",
                        "enabled": True,
                        "data": {
                            "http_client_timeout": "3000",
                            "interval": "60",
                            "initial_interval": "60",
                            "batch_size": 100,
                            "preserve_original_event": True,
                            "preserve_duplicate_custom_fields": True,
                            "tags": ["tag1", "tag2"]
                        }
                    }
                ]
            }]
        }

```

Has anyone successfully automated this process and can share insights on the correct request structure ?

Could the issue be due to API version changes or documentation inconsistencies ?

Any suggestions for troubleshooting this issue further would be greatly appreciated.

Thank you in advance for your help and suggestions!

---

<div class="post-metadata">

### Author: ![bl4ck-m33k4t](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bl4ck-m33k4t/32/130906_2.png) [@bl4ck-m33k4t](https://discuss.elastic.co/u/bl4ck-m33k4t)
#### Post date: [January 18, 2024, 1:21pm UTC](https://discuss.elastic.co/t/automating-sophos-central-agent-policies-integration-via-python/351349/2 "2024-01-18T13:21:58Z")

</div>

Issue Resolved.

For those of you interested in how to achieve this:

1. Create a Sophos Central integration manually.

2. Obtain the preview API request.  

3. Submit this request to DevTools.

4. Extract and use the functional structure.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 15, 2024, 1:22pm UTC](https://discuss.elastic.co/t/automating-sophos-central-agent-policies-integration-via-python/351349/3 "2024-02-15T13:22:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
