> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Sophos Integration Guide
## Overview
This guide describes how to integrate **OneFirewall Alliance (OFA) Threat Feeds** into **Sophos Firewall** using External Dynamic Lists (EDLs). The integration enables automatic enforcement of security rules based on live threat intelligence from OneFirewall, covering both **inbound** and **outbound** traffic.
## Prerequisites
* Sophos Firewall **20.0+**.
* A VM with the latest Ubuntu LTS, Docker, and Docker Compose, to host the WCF Agent.
## Step 1: Generate the Agent Configuration
1. Log into your OneFirewall Alliance profile.
2. Navigate to the **Install Agent** section.
3. Select **Sophos** from the dropdown menu and fill in the Sophos API information (URL, user, password). Start with a tolerant score threshold (e.g. 200) — this can be changed later from the agent-status page at runtime.
4. Save the generated `config.json` securely — it will be used to authenticate feed requests.
## Step 2: Install the WCF Agent
1. Contact [support@onefirewall.com](mailto:support@onefirewall.com) for the installation file (this step will be integrated into the portal in a future release).
2. Create a `wcf-agent` folder in a filesystem path of your choice.
3. Unpack the installation file and follow the instructions in the `README` file. Place the downloaded `config.json` in the `onefirewall/config` folder.
## Step 3: Create Security Policies
The Sophos API is the address URL of the Sophos Firewall Dashboard, e.g. `192.168.1.1:443`.
The agent creates blacklists — external dynamic lists containing the IP threats from OneFirewall — named as shown in the screenshots below.
Once started, configure Inbound/Outbound firewall **rules and criteria** on the Sophos firewall as shown:
