diff --git a/Sophos/ossec.conf b/Sophos/ossec.conf
new file mode 100644
index 0000000..ecee5f3
--- /dev/null
+++ b/Sophos/ossec.conf
@@ -0,0 +1,4 @@
+<localfile>
+    <log_format>json</log_format>
+    <location>/opt/Sophos-Central-SIEM-Integration/log/result.json</location>
+  </localfile>