Integration · Firewalls and edge
Sophos Firewall
Blocks an attacker’s address through your Kandaro block list, which the firewall pulls by itself.
What Kandaro does with it
Kandaro SOC and Sophos Firewall.
Block an attacker’s address at the edge, on your approval, and lift it again by itself.
- Respond
Proposes these actions, and can run them through it once an admin approves:
- Add an address to your block list
How it connects
Pick the way that fits.
- Block list feed
Your firewall pulls Kandaro’s block list every few minutes. Kandaro never logs in to it.
What Kandaro needs
What you set up once.
- A firewall rule that reads the list with its own read-only password. Kandaro never logs in to your firewall.
When Kandaro acts
A person says yes first.
The AI never closes a case and never acts on its own: every action waits for a person to approve it.
A person approves every action
Only an admin can approve, with a fresh second factor bound to that one action. Never from a chat message or an email link. A second approver can be required.
Proposals, not surprises
By default Kandaro shows the steps and you run them in your own tool. Letting Kandaro run them itself is a switch you turn on, after signing the SOC terms.
Everything can be reversed
Every block, disable and isolation can be reversed, most with one click. Blocks also end by themselves after a set time; a Wazuh block always runs its full 24 hours.
Limits and a pause button
Kandaro caps how many actions can run per hour, never acts on addresses in your allow list, and one switch pauses every action at once.
Firewalls and edge
More tools like this.
Cloudflare
Blocks an attacker’s address at Cloudflare for a set time, and lifts it again by itself.
- Respond
- Vendor API
Palo Alto Networks
Blocks an attacker’s address through your Kandaro block list, which the firewall pulls by itself.
- Respond
- Block list feed
Fortinet FortiGate
Blocks an attacker’s address through your Kandaro block list, which the firewall pulls by itself.
- Respond
- Block list feed
Connect Sophos Firewall to Kandaro SOC.
Request early access to Kandaro SOC, or start a 14-day trial of Kandaro Deception today.
Deception trial: card required · cancel before day 14 and pay nothing