Sensor Configuration

​

Overview

• API-Based
• Agent-Based

​

API-Based Setup

​

Agent-Based Setup

​

Step 1: Activation

1. Log in to your OneFirewall Server instance, open the main menu on the right, and click Install Agent.
2. Select the device you want to activate.
3. Define the following parameters:
   • IoC Type — Choose between IP, URL, Domain, or File.
   • Cyber Crime Threshold — Set the sensitivity level at which the device starts blocking threats.
   • Sync Interval — Define how often the agent updates its IoC data.

​

Step 2: Download Configuration

1. Prepare a virtual machine with Docker and Docker Compose installed.
2. Download the docker-compose.yml file from the previous step and place it on the new machine. This file contains the parameters (including your certificate) the agent needs to connect securely to your OneFirewall Server.
3. Start the agent:

docker-compose up -d

​

Step 3: Setup Access

1. Navigate to the Agent Status page from the menu to see the list of installed agents.
2. Click View & Edit on the newly installed agent to open its JSON configuration form.
3. Scroll to the ips section of the JSON and set your own parameters. See the examples below.

​

Notes

​

Sophos

   "ips": {
        "sophos": {
            "active": true,
            "user": "<your device username>",
            "password": "<your device password>",
            "address": "<the address or hostname of your sophos>",
            "command": "bash artifacts/sophos/update_blacklist_sophos.sh"
        }
   }

​

Checkpoint SecureXL

   "ips": {
        "checkpoint_securexl": {
            "active": true,
            "connections": "<your device user>@<the address or hostname of your checkpoint>",
            "password": "<your device password>",
            "command": "bash artifacts/checkpoint/install-securexl.sh",
            "vsids": "<VSID separated by comma>"
        },
   }