• Enhanced Protection EAP opening for Server

    We have opened up the Early Access Program to include Windows Server 2008R2 and later!

    For now, the same Intercept X and AMSI features as found in the endpoint will be available, with Intercept X initially only in detection mode, not blocking. (Update: Note that meanwhile these features are now also set to block exploits).

    The AMSI interface is available on Windows Server 2016 and Windows Server 2019.


    Devices with…

    • 14 Jan 2020
  • New Intercept X features now blocking exploits

    A few weeks ago we updated your machines in the EAP with four new Intercept X exploit mitigation types.

    While these features were active in terms of scanning for and detecting of potential exploits, users have not seen any threats blocked based on these mitigation types. After having run this on your machines in silent mode, we are now confident to start blocking detections of these exploits.

    As a reminder, these are the…

    • 28 Nov 2019
  • Enhanced Protection EAP extended with new Intercept X features

    Starting tomorrow, we’ll extend the Early Access Program for Enhanced Protection with some new Intercept X features for you to test. Four new mitigation options will be added to endpoints that are participating in the EAP. 

    All four new mitigation options can individually be switched off or on – but as with other EAP features, they’ll be on by default. However, you will not yet see any detections based…

    • 15 Nov 2019
  • Intercept X Enhanced Protection EAP is now open!

    We are pleased to announce that the new EAP that introduces AMSI Protection and Malicious Network Traffic Protection (IPS) is now open.

    Check out the attached slides, or watch this video to find out how to join.

    For questions and feedback, please visit the Feedback and Issues forum

    • 18 Oct 2019
  • Announcing Early Access for Enhanced Protection / IPS and AMSI

    Can the best get any better? We sure think so! Our teams have been working hard to add new protection focused features to Central Windows Endpoint & Windows Server. The Early Access Program is due to launch in late October, the full list of included products can be found later in this blog post.


    Sophos Network Threat Protection just got better! We're adding Malicious Network Traffic Protection with Packet Inspection…

    • 4 Oct 2019
  • Introducing Intercept X for Server with EDR

    After the closure of the Early Access Program (EAP) for our endpoint EDR capabilities we are happy to announce that we have commenced a new EAP giving access to Server EDR capabilities. Check out this post for more detail.

    • 5 Mar 2019
  • Fakedrop - a quick and dirty testing and demo tool for EDR

    Fakedrop is a fake malware dropper to help you safely simulate some suspicious and malicious activity on Sophos Intercept X protected endpoints without fear of causing a malware outbreak. This also means the tool is only for use with our products and not competitors. The code is quick and dirty however it helps get the job done.

    It's designed to be run one or more machines protected by Intercept X (with the Advanced with…

    • 19 Feb 2019
  • Intercept X Advanced with EDR Early Access Program Closing Down

    On January 31st the Intercept X Advanced with EDR Early Access Program (EAP) will be closing down. From January 21st the EAP will be closed to new customer registrations and no new endpoints can be assigned to the Early Access Program for existing customers who have joined the EAP.

    What will the experience be for customers coming out of the Early Access Program on January 31st?

    For customers who had joined the Early Access…

    • 19 Jan 2019
  • Best Practices for EDR Data Feed

    One of the key new features delivered in Intercept X Advanced with EDR is the ability to search across an endpoint estate for details on portable executable files that have an uncertain or bad reputation and the network destinations those files have connected to. This will search across all the data that has been sent back to Sophos Central but only from Endpoints that have Threat Protection policies with the ‘Allow computers…

    • 11 Jan 2019
  • Intercept X Advanced with EDR Early Access Program Updates - December 2018

    Now that the Intercept X Advanced with EDR offering is now available for purchase, we wanted to provide Early Access Program customers some best practices for migrating from the Early Access Program to an Intercept X Advanced with EDR license for those who have made the decision to purchase.


    Migration Steps:
    1. Apply the Activation code for the “Intercept X Advanced with EDR” license on the Licensing page in Sophos Central…

    • 21 Dec 2018
  • Intercept X Advanced with EDR Early Access Program Updates

    Another round of updates have been released as part of the Endpoint Detection and Response early access program. The latest new enhancements include:


    Threat Search to now support Network Events:

    The endpoint will be enhanced so that on top of tracking and sending metadata to Sophos Central on detected or suspicious portable executable files, it will also now start to track network connections to IP addresses and domains…

    • 9 Nov 2018
  • Submit Your Files to SophosLabs and Win Prizes!

    Deep Learning Malware Analysis is now available as part of the Intercept X Advanced with EDR Early Access Program.  When clicking on a file you can now submit it to SophosLabs to receive the latest threat intelligence, driven by our deep learning malware analysis engine.  This exciting feature automatically analyzes malware in extreme detail, breaking down file attributes and code and comparing them to millions of other…

    • 1 Nov 2018
  • Deep Learning Malware Analysis introduced to Intercept X EDR Early Access Program.

    Feedback when requesting the latest Sophos Threat intelligence on processes from within Threat Cases has been vastly improved with the introduction of Deep Learning Malware Analysis to the Intercept X EDR Early Access Program. This feature automatica...
    • 8 Oct 2018
  • EDR Early Access Program Test Guide Available Now

    As testing some of the new Endpoint EDR capabilities can be a bit tricky, Sophos have put together a Test Guide to help demo and test the new capabilities.  The Test Guide walks through the scenarios below:


    1. The investigation of an existing detection where suspect files are identified in the threat chain which warrant further investigation. A file is submitted to SophosLabs for further analysis, an Item Search across…
    • 4 Oct 2018
  • Intercept X with EDR Early Access Program Now Open

    The best just got better. Sophos is pleased to announce that the Intercept X Advanced with EDR Early Access Program is now open.  The new Endpoint Detection and Response (EDR) capabilities allow you to take charge of security incidents by answering the tough questions about an event, investigate with deep expertise, and respond with a click of a button.  The EAP is open to Central Endpoint Protection Intercept X customers…

    • 17 Sep 2018
  • Sophos Endpoint Detection and Response - Private EAP Update

    Thursday, the 13th of September, Sophos plans on launching the next round of capabilities as part of the EDR Private Early Access program. The new capabilities being launched in this part of the Early Access Program are:


    Respond Capabilities

    In the event potential undetected threats have been identified, new respond capabilities can be applied to help contain the threat. Admin led isolation can restrict the network connectivity…

    • 12 Sep 2018
  • Using the SDR Exporter

    Demo of SDR Exporter and RCA Threat Case investigation:

    For the attack to get as far as it did I had to turn off 90% of the Sophos endpoint protections.  In the scenario the adversary compromises the endpoint and downloads multiple malware tools only one of which is caught.  The RCA will show both the convicted software and the suspect files downloaded that did not trigger a detection.The SDR Exporter can be used to see…

    • 25 Jul 2018
  • Sophos Endpoint Detection and Response - Private Early Access Program

    Sophos are pleased to announce the Endpoint Detection and Response early access program for Central Windows Endpoints.  The new Sophos Endpoint Detection and Response capabilities empower admins with deeper insights into the activity on their endpoints to identify and respond to advanced threats.  Initially this will be a private early access program before opening up to a public early access program in a few months.  If…

    • 19 Jul 2018