Note: Customers can join early access programs and use EAP features free of charge.  Use of all features and functionalities provided under the Early Access Program is subject to the Sophos End User License Agreement.  

The New Endpoint/Server Protection Features Early Access Program allows customers to test the latest and greatest endpoint and server features and functionality as they are being developed by Sophos.

Keep…

Starting today we are gradually rolling out Sophos AMSI Protection to the Recommended release for endpoints. In a first phase only new Sophos Central customers (with the right license), and a very small percentage of existing Sophos Central customers will see this.

While we have tested this technology a lot, internally as well as in this EAP, it is still a new technology so we want to be sure all works well.

If all goes…

Starting this week we will gradually roll out an update to the components in the Enhanced Protection EAP. We are mainly focusing on improved quality, and have fixed most of the issues that have been reported. Both endpoints and servers will be updated.

Other changes are the introduction of Windows 7 support for IPS, and a new and faster SDU log collection.

This roll-out will take about two weeks.

The update will bring…

The same Intercept X features that protect your endpoints are now also activated for the Windows Servers participating in the Server Protection EAP have are now also blocking exploits.

While these features were active in terms of scanning for and detecting of potential exploits, admins have not seen any threats blocked based on these mitigation types. After having run this on your servers in silent mode, we are now confident…

We have opened up the Early Access Program to include Windows Server 2008R2 and later!

For now, the same Intercept X and AMSI features as found in the endpoint will be available, with Intercept X initially only in detection mode, not blocking. (Update: Note that meanwhile these features are now also set to block exploits).

The AMSI interface is available on Windows Server 2016 and Windows Server 2019.

Versions

Devices with…

A few weeks ago we updated your machines in the EAP with four new Intercept X exploit mitigation types.

While these features were active in terms of scanning for and detecting of potential exploits, users have not seen any threats blocked based on these mitigation types. After having run this on your machines in silent mode, we are now confident to start blocking detections of these exploits.

As a reminder, these are the…

Starting tomorrow, we’ll extend the Early Access Program for Enhanced Protection with some new Intercept X features for you to test. Four new mitigation options will be added to endpoints that are participating in the EAP. 

All four new mitigation options can individually be switched off or on – but as with other EAP features, they’ll be on by default. However, you will not yet see any detections based…

We are pleased to announce that the new EAP that introduces AMSI Protection and Malicious Network Traffic Protection (IPS) is now open.

Check out the attached slides, or watch this video to find out how to join.

For questions and feedback, please visit the Feedback and Issues forum

Can the best get any better? We sure think so! Our teams have been working hard to add new protection focused features to Central Windows Endpoint & Windows Server. The Early Access Program is due to launch in late October, the full list of included products can be found later in this blog post.

IPS

Sophos Network Threat Protection just got better! We're adding Malicious Network Traffic Protection with Packet Inspection…

After the closure of the Early Access Program (EAP) for our endpoint EDR capabilities we are happy to announce that we have commenced a new EAP giving access to Server EDR capabilities. Check out this post for more detail.

Fakedrop is a fake malware dropper to help you safely simulate some suspicious and malicious activity on Sophos Intercept X protected endpoints without fear of causing a malware outbreak. This also means the tool is only for use with our products and not competitors. The code is quick and dirty however it helps get the job done.

It's designed to be run one or more machines protected by Intercept X (with the Advanced with…

On January 31st the Intercept X Advanced with EDR Early Access Program (EAP) will be closing down. From January 21st the EAP will be closed to new customer registrations and no new endpoints can be assigned to the Early Access Program for existing customers who have joined the EAP.


What will the experience be for customers coming out of the Early Access Program on January 31st?

For customers who had joined the Early Access…

One of the key new features delivered in Intercept X Advanced with EDR is the ability to search across an endpoint estate for details on portable executable files that have an uncertain or bad reputation and the network destinations those files have connected to. This will search across all the data that has been sent back to Sophos Central but only from Endpoints that have Threat Protection policies with the ‘Allow computers…

Now that the Intercept X Advanced with EDR offering is now available for purchase, we wanted to provide Early Access Program customers some best practices for migrating from the Early Access Program to an Intercept X Advanced with EDR license for those who have made the decision to purchase.

 

Migration Steps:
 
1. Apply the Activation code for the “Intercept X Advanced with EDR” license on the Licensing page in Sophos Central…

Another round of updates have been released as part of the Endpoint Detection and Response early access program. The latest new enhancements include:

 

Threat Search to now support Network Events:

The endpoint will be enhanced so that on top of tracking and sending metadata to Sophos Central on detected or suspicious portable executable files, it will also now start to track network connections to IP addresses and domains…

Deep Learning Malware Analysis is now available as part of the Intercept X Advanced with EDR Early Access Program.  When clicking on a file you can now submit it to SophosLabs to receive the latest threat intelligence, driven by our deep learning malware analysis engine.  This exciting feature automatically analyzes malware in extreme detail, breaking down file attributes and code and comparing them to millions of other…

Feedback when requesting the latest Sophos Threat intelligence on processes from within Threat Cases has been vastly improved with the introduction of Deep Learning Malware Analysis to the Intercept X EDR Early Access Program. This feature automatica...

As testing some of the new Endpoint EDR capabilities can be a bit tricky, Sophos have put together a Test Guide to help demo and test the new capabilities.  The Test Guide walks through the scenarios below:

 

1. The investigation of an existing detection where suspect files are identified in the threat chain which warrant further investigation. A file is submitted to SophosLabs for further analysis, an Item Search across…

The best just got better. Sophos is pleased to announce that the Intercept X Advanced with EDR Early Access Program is now open.  The new Endpoint Detection and Response (EDR) capabilities allow you to take charge of security incidents by answering the tough questions about an event, investigate with deep expertise, and respond with a click of a button.  The EAP is open to Central Endpoint Protection Intercept X customers…

Thursday, the 13th of September, Sophos plans on launching the next round of capabilities as part of the EDR Private Early Access program. The new capabilities being launched in this part of the Early Access Program are:

 

Respond Capabilities

In the event potential undetected threats have been identified, new respond capabilities can be applied to help contain the threat. Admin led isolation can restrict the network connectivity…

Demo of SDR Exporter and RCA Threat Case investigation:

For the attack to get as far as it did I had to turn off 90% of the Sophos endpoint protections.  In the scenario the adversary compromises the endpoint and downloads multiple malware tools only one of which is caught.  The RCA will show both the convicted software and the suspect files downloaded that did not trigger a detection.The SDR Exporter can be used to see…

Sophos are pleased to announce the Endpoint Detection and Response early access program for Central Windows Endpoints.  The new Sophos Endpoint Detection and Response capabilities empower admins with deeper insights into the activity on their endpoints to identify and respond to advanced threats.  Initially this will be a private early access program before opening up to a public early access program in a few months.  If…