Looks like Sophos has reverted back to com.sophos.scan
for Endpoint 10.0.3 process name running on macOS Big Sur:
% sw_vers
ProductName: Mac OS X
ProductVersion: 10.15.7
BuildVersion: 19H524
% /usr/bin/defaults read /Library/Sophos\ Anti-Virus/product-info ProductVersion
10.0.3
% /bin/launchctl list | /usr/bin/awk '/com.sophos.scan/{ print $3}'
com.sophos.scan.legacy
% sw_vers
ProductName: macOS
ProductVersion: 11.2.1
BuildVersion: 20D75
% /usr/bin/defaults read /Library/Sophos\ Anti-Virus/product-info ProductVersion
10.0.3
% /bin/launchctl list | /usr/bin/awk '/com.sophos.scan/{ print $3}'
com.sophos.scan
We're testing out the following Jamf Pro Extension Attribute:
#!/usr/bin/env bash
##########################################################################
# A script to collect the process state of Sophos Endpoint. #
# If Sophos Endpoint is not installed, "Not Installed" will be returned. #
##########################################################################
RESULT="Not Installed"
if [[ -d /Applications/Sophos/Sophos\ Endpoint.app ]]; then
sophosScanAgentName=$( /bin/launchctl list | /usr/bin/awk '/com.sophos.scan/{ print $3}' )
RESULT=$( /bin/launchctl print system/${sophosScanAgentName} | /usr/bin/awk '/state/{ print $3}' )
fi
/bin/echo "<result>${RESULT}</result>"