Log: sophos-xg-admin-login
device_name="SFW" timestamp="2026-08-11T10:44:18+0300" device_model="XGS136" device_serial_id="S0000000000000A" log_id="017309618002" log_type="Admin" log_component="GUI" log_subtype="System" log_version=1 severity="Information" user_name="admin" src_ip=10.10.5.51 status="Successful" message="User admin logged in successfully to the WebAdmin console"
For: Sophos XG / SFOS firewall
Meaning: An administrator signed in to the Sophos WebAdmin console.
log_type=Admin with
log_component=GUI tells you this was the web interface rather than SSH or the API,
status=Successful that it worked, and the source 10.10.5.51 that it came from inside the network.
On its own this is routine. It is worth keeping because administrative access to a firewall is exactly what an auditor asks to see, and because the interesting version of this log is the one that arrives at three in the morning from an address nobody recognises.
What to do: None for a normal working-hours login from a known address. Worth alerting on if it comes from an unexpected source, outside working hours, or under a shared account name like admin rather than a named person. PCI DSS 10.2.1.2 asks for exactly this record: every action taken with administrative privilege, attributable to an individual.
Get
Started