--- title: Sophos EDL Integration description: Sophos Group is a British security hardware and software company that has been working in network and system security software for the past 30 years. Powered by SophosLabs, their AI-enhanced and cloud-native solutions provide high adaptation and flexibility characteristics in a network. From the vast variety of protective software and hardware, the Sophos Xstream Firewall is engineered to bring extreme levels of visibility, protection, and performance to any network. With deep packet inspection and application acceleration, Sophos delivers powerful protection and performances to mitigate the greatest challenges faced by network administrators today. --- [Skip to content](https://content.sirp.io/knowledge-base/sophos-edl-integration-help-center-sirp#main-content) English Show submenu for translations [Customer portal](https://content.sirp.io/customer-portal?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png)](https://sirp.io/) Open main navigation Close main navigation - English Show submenu for translations - [Customer portal](https://content.sirp.io/customer-portal) - [Contact us](https://content.sirp.io/customer-portal/new) [Contact us](https://content.sirp.io/customer-portal/new?hsLang=en) What would you like to automate today? - There are no suggestions because the search field is empty. 1. [SIRP Help Center](https://content.sirp.io/knowledge-base?hsLang=en) 2. [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) # Sophos EDL Integration ### **About Sophos EDL** Sophos Group is a British security hardware and software company that has been working in network and system security software for the past 30 years. Powered by SophosLabs, their AI-enhanced and cloud-native solutions provide high adaptation and flexibility characteristics in a network. From the vast variety of protective software and hardware, the Sophos Xstream Firewall is engineered to bring extreme levels of visibility, protection, and performance to any network. With deep packet inspection and application acceleration, Sophos delivers powerful protection and performances to mitigate the greatest challenges faced by network administrators today. An External Dynamic List is a text file containing IOCs (URLs and domains) that the Sophos firewall uses/syncs with to enforce its block and unblock policies. ### **Supported Actions** SIRP’s Sophos EDL integration app allows you to execute the following actions: | **S.no** | **Action** | **Description** | | --- | --- | --- | | 1 | Block URL | Block a URL on Sophos firewall | | 2 | Unblock URL | Unblock a URL on Sophos firewall | | 3 | Block Domain | Block a domain on Sophos firewall | | 4 | Unblock Domain | Unblock a domain on Sophos firewall | ### Enable the Palo Alto EDL App in SIRP 1. First, log in to SIRP, then go to **Apps** from the left navigation bar. 2. Locate the app named **Sophos EDL.** 3. **Enable** the Sophos app by clicking on the toggle button under the Status   [![](https://downloads.intercomcdn.com/i/o/534557444/9f9ab8896efc10d14185be03/image.png?expires=1752237000&signature=e138ce7260f6d92814d017065687614eeb7dbadee89e4aadbd813f81f561aab8&req=cSMjE8x5mYVbFb4f3HP0gPhJb6l6oQCrm8A30IKpZQjB%2BaoUwVwgGQlselpv%0Anlc%3D%0A)](https://downloads.intercomcdn.com/i/o/534557444/9f9ab8896efc10d14185be03/image.png?expires=1752237000&signature=e138ce7260f6d92814d017065687614eeb7dbadee89e4aadbd813f81f561aab8&req=cSMjE8x5mYVbFb4f3HP0gPhJb6l6oQCrm8A30IKpZQjB%2BaoUwVwgGQlselpv%0Anlc%3D%0A) 4. Once enabled, click on the configuration button to add the following configuration: 1. Configuration Name \ 2. EDL-Name \   [![](https://downloads.intercomcdn.com/i/o/534557538/59ac723cf00b816f3b9b4f4b/image.png?expires=1752237000&signature=7513c0f7f82227bb8fc233dff4bb5fc62498e6abeb6e747af47bb3c6897ee0f0&req=cSMjE8x5mIJXFb4f3HP0gKZwrAznIlTwBZw7g0SUN3NiY27P8q0LmeORIFWB%0AF7Y%3D%0A)](https://downloads.intercomcdn.com/i/o/534557538/59ac723cf00b816f3b9b4f4b/image.png?expires=1752237000&signature=7513c0f7f82227bb8fc233dff4bb5fc62498e6abeb6e747af47bb3c6897ee0f0&req=cSMjE8x5mIJXFb4f3HP0gKZwrAznIlTwBZw7g0SUN3NiY27P8q0LmeORIFWB%0AF7Y%3D%0A) 5. Execute the following supported actions one by one on any particular container (incident or alert) or from Automation Playground: - BLOCK URL - BLOCK DOMAIN 6. As each action gets executed, you will get unique URLs of the EDL files. For example: - https://\/Sophos/2/url\_list.txt - https://\/Sophos/2/domain\_list.txt 7. Use these URLs to configure the EDL in the Sophos Firewall by following these steps: ### Configure EDL in Sophos 1\. Log in to the Sophos **Web Console**. 2\. Access the **Web** tab 3\. Add a new a block in **Categories** a) Set **Name** to **SIRP\_URL\_BLOCK** b) Set **Classification** to **Objectionable.** c) Set **Configure category** to **External URL Database** d) Add URLs (from your SIRP actions) and **Save** o https://\/Sophos/2/url\_list.txt o https://\/Sophos/2/domain\_list.txt [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-56-02-4425-AM.png)](https://downloads.intercomcdn.com/i/o/534559930/3a42e2c059ca222199858685/image.png?expires=1752237000&signature=114b127a1898d4a5839a3d567f0b51722fec62c5acf3b07ebe08437041e693a5&req=cSMjE8x3lIJfFb4f3HP0gMRh73CQqxKvMOz3mgUeNLW6IjQLLPJHeurJI1X1%0AeMrdqJhby8Og3M6Wlw%3D%3D%0A)   After the last step, you should be able to execute the Sophos actions on-demand or through Playbooks to block and unblock domains and URLs. [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-56-06-8711-AM.png)](https://downloads.intercomcdn.com/i/o/534563443/67615d3101075e3effbcfe52/image.png?expires=1752237000&signature=6f3058e7af7de85f1ad3330d49dab9e2126bd202cebf1b4ee65038a970001d2f&req=cSMjE899mYVcFb4f3HP0gD6%2FTdmo5JKMkSKZRc%2BHf9ABNH4YFAqyjkm0klb4%0AEldGgIUnZ8wTZtQ%2Big%3D%3D%0A) - [SIRP Community](https://content.sirp.io/knowledge-base/sirp-community?hsLang=en) - [Playbook Guide](https://content.sirp.io/knowledge-base/playbook-guide?hsLang=en) - [User Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#main-content) - [IM Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#im-guide) - [Admin Guide](https://content.sirp.io/knowledge-base/admin-guide?hsLang=en) - [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) - [Release Notes](https://content.sirp.io/knowledge-base/release-notes?hsLang=en) - [Add on Apps](https://content.sirp.io/knowledge-base/add-on-apps?hsLang=en) - [Architecture](https://content.sirp.io/knowledge-base/architecture?hsLang=en) - [Use Cases](https://content.sirp.io/knowledge-base/use-cases?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png "SIRP-Logo-4c-KO")](https://sirp.io) ### Global Headquarter ##### United States 7735 Old Georgetown Rd, Suite 510 Bethesda, MD 20814 [+1 888 701 9252](tel:+18887019252) [mailto:email@email.com](mailto:email@email.com) Copyright © 2025, SIRP Labs Inc