Josh,
Rebooting may help, but if you know what the device is (Sophos WS) and where it logs to (which local facility on the LEM?) you can create the connector manually and the LEM should detect and break out all the devices sending logs to that location.
In Manage --> Appliances, click the gear next to your LEM, and pick "Connectors." Refine the Results with Sophos, and then click the gear next to the appropriate connector and select "New." It'll have settings for log file location, and you can modify that if needed, or accept the defaults if you think they are correct. Save and start your connector, and the LEM ought to pick up the nodes.