Firewall visibility and rule management in one place

Once a firewall is feeding the platform, its raw output becomes structured records instead of console screens. Traffic events land as firewall logs with source, destination, protocol and the action the appliance took, so "what did the firewall actually do at 2am?" is a filterable query, not a scroll through a vendor UI. Rules and policies are listed with their status, giving reviewers a readable inventory of what the appliance currently enforces.

Blocked traffic gets its own treatment: each blocked IP is recorded with a threat level, so the block list reads as a ranked picture of what is probing your edge rather than an undifferentiated dump. Per-device statistics aggregate the volumes over time, which is what most audits and monthly reviews really need — the shape of the traffic, not each individual packet.

Everything sits in the same workspace as server monitoring and network monitoring, which is the point: an engineer chasing an incident moves between the firewall view, the affected server and the open ticket without switching products.

Threat records carry a named category — malware, ransomware, phishing, botnet, trojan, worm, spyware, adware, DDoS attack or brute force — alongside a severity and a working status. That classification matters in practice: a brute-force burst against a VPN port and an adware callout from a user laptop are both "threats", but they demand different responses, and a category-labelled queue lets you route each to the right person immediately.

On top of the threat details, typed alerts (security threat, high bandwidth, DDoS, intrusion attempt, malware, policy violation) surface the conditions worth interrupting someone for. The whitelisted-domains list closes the loop on false positives: once a legitimate destination is whitelisted it stays out of future threat noise, so the queue tends to get quieter and more trustworthy as the deployment matures.

Each threat also carries a working status — active, mitigated, resolved or false positive — so triage has somewhere to land instead of an undated list. Combined with per-severity filtering, a small team can honestly say which of last month's threats were acted on, which were dismissed as false positives, and which are still open.

Sophos appliances connect through a direct API client, which pulls state without any change to your logging pipeline. FortiGate, Palo Alto and other appliances integrate the way network gear always has — you point their syslog output at the platform's ingestion endpoint, and the parser turns those messages into the same structured logs, blocked-IP records and threat details the Sophos path produces. The setup effort is one forwarding rule on the appliance.

A scheduled task then refreshes each firewall's cached view and aggregate statistics on roughly a five-minute cycle. The cache is a deliberate design choice: dashboards load instantly and repeated page views never hammer the appliance's management plane, while the data stays recent enough for operational review. This is a monitoring layer by design — the appliance remains the enforcement point, and nothing here pushes rule changes to it.

Each registered device also carries its own operational record: vendor type, connection protocol, an online/offline status and a monitoring state. For a team running several appliances across sites, that turns "is the branch firewall even reporting?" into a glance at the device list — a silent appliance stands out as offline instead of being noticed only when its logs are missed during an investigation.