Engineering found this (thanks Martina!).
Sophos Central provides SIEM Integration Script, and I believe that there can be configured syslog CEF (we support CEF format in the Sophos Central connector) by editing config.ini with the syslog values.
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.