Addition of Sophos EDR Custom Inregation

[JamieJoness]

Adds a new inbound integration for Sophos EDR (sophos-edr), importing computer and server endpoints from Sophos Central via the Endpoint API.

How it works:

Authenticates with OAuth2 client credentials at id.sophos.com (scope=token), with automatic re-auth if the 1-hour JWT expires mid-run.
Discovers the tenant ID and regional data host via GET /whoami/v1; optional tenant_id / data_region_url parameters support partner and organization service principals.
Pages through GET /endpoint/v1/endpoints?view=full (pageSize=100, key-based nextKey pagination), streaming each page via report_assets so large inventories are never buffered in memory.
Optional filters: endpoint type (computer/server) and a last-seen window (lastSeenAfter).
Imported data: hostname, OS + version, all IPs/MACs as network interfaces, deviceType=Server where applicable, assigned Sophos products as software entries, and ~30 custom attributes (health, tamper protection, isolation, lockdown, encryption volumes, cloud provider/instance, group hierarchy, associated person, serial number, online/cloned flags, last-seen/OS-update/agent-update timestamps, tags).

Asset identity: scoped authoritative foreign ID sophos:: (documented required UUID), with matchBehavior="no-mac-break no-ip-break no-name-break". Records without an ID are skipped — no random fallbacks. Full decision record is in the integration README.

Validation: compiles and loads via the platform compatibility test (TestCompat_AllShippedIntegrationsLoad), and main was exercised end-to-end against mocked Sophos API responses covering pagination, 401 token refresh, malformed records, duplicate hostnames, and ID stability across repeated runs. Not yet validated against a live Sophos tenant. Catalog metadata (integrations.json, root README) regenerated.

Checklist
New Integration Folder: A new folder has been created for the integration.
Updated README: The README has been updated based on the boilerplate to reflect the new integration details.
Integration script: The .star file has been created/updated as required.
Embedded CONFIG: The script's CONFIG block declares the name (product name), type (inbound, outbound, or internal), parameters, and any shared option-set includes.

[Copilot]

Pull request overview

Adds a new inbound custom integration (sophos-edr) that imports Sophos Central Endpoint inventory into runZero, including endpoint health/protection metadata and streaming pagination to avoid buffering large datasets.

Changes:

• Introduces sophos-edr Starlark integration to authenticate via OAuth2, discover tenant/region via /whoami/v1, and page through /endpoint/v1/endpoints?view=full while streaming assets with report_assets.
• Adds integration-specific documentation (sophos-edr/README.md) detailing setup, parameters, and asset identity strategy.
• Updates catalog/index metadata (root README.md list and docs/integrations.json) to include Sophos EDR.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
sophos-edr/sophos-edr.star	New inbound integration script implementing Sophos Central endpoint import with paging + streaming.
sophos-edr/README.md	New integration documentation (setup, parameters, identity, and field mapping).
README.md	Adds Sophos EDR to the repository’s integration list.
docs/integrations.json	Registers Sophos EDR in the generated integrations catalog metadata.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.