Hello
I had a look through Detection's and Investigations today
Detection's
- There seems to be an issue with the filters - I see it show "4 filters" applied when first opening page BUT then when showing the filters 5 filters are shown as selected (risk 6 - 10 = 5) -- applying immediately applies 5 filters. minor issue but there in our instance.
- Perhaps some indication of how many detection's there are as for many customers - where there are no issues (good thing) - they will just see a blank page and have no idea what this feature does at first glance. There are many risk level 5 detection's that could help show customers immediately what this is doing.
- The machine learning engine needs to take into account other processes that are being called and or referenced by any given process and provide information on all of these .. this is usually the actual crux of the issue and is blindingly obvious..
eg -- What is the point in running ML type checks against the "reg.exe" process - ie well known trusted windows process -- WHEN it is blindingly obvious when looking at the command line parameters that this command is being used to load another executable - I would like Sophos to assess the other executable NOT the super common one -- same thing with msiexec and rundll etc -- this is the actual thing that needs to be assessed not "reg.exe"
The Pa - Other than this this is an improvement over the previous system. And this is certainly essential to "automatically" - not manual like other XDR tasks - discover threats in the environment - So pretty good except where it comes to Investigations....
Investigations
- This looks half finished in the instance I am seeing.
- I get an error when trying to add detection to an investigation - Failed to add detection - please try again -- I have not been able to get this to work
- Why do I need to create an investigation first and then add detection to this? from the detection page I should be able to kick off an investigation on what I am seeing. as above even if this could work that workflow seems bonkers.
- Why is this essentially a re-write of the existing "investigations" tech in threat graphs? How will the now possibly two investigation systems work?
- After creating an Investigation and closing and/or archiving it It still sits there -- why?? this is the same as the threat graphs "investigations" -- why is "Show All" the default view .. it should be "Show New" -- if Ive closed/archived a case I don't want to ever see it again only if I need to look for it .. How would this possibly scale to more than 20 investigations? We have seen zero customers uptake using this system to undertake investigations because it just does not make sense.
- There needs to be a way for me to make a rule as part of an investigation to detect similar type investigations and auto-close them as such.. This system is prone to massive noise reporting all the same things over and over again - If a technician goes through the process to investigation.. and more often than not discovers a false positive (99% of cases) they need a way to have the time they spend on this not wasted -- if tomorrow the same detection happens again then what is the point. Creating a quick rule or automated if required to ensure the detection's they are working on are filed away and dont create alerts.
- Where is the search and/or column sorting options for any Investigations? .. with 1-5 investigations it might not be a problem but if this was to be used for 5 or more it would become a massive annoyance.
- Whats the point of an "Actions" button that only has one action in it .. again It look like this is half finished which is fine - its early access - although in any of the early access programs I have not seen any significant changes occur during the release .. But still I would say that there should be at least one button for the main action admins need to do (create investigation perhaps) and then an actions button for other actions (you need some other actions.
I really do hope this improves as this is one of the big missteps with XDR -- Customers cannot see the benefits -- there needs to be much much more things that can be setup to automatically help customers without any involvement otherwise they will not do anything -- I know a selling point for MTR but still the base product should at least provide an automated benefit.
Sophos really need to work on making it easy for customers to discover useful information from endpoints -- another pass over the whole XDR method of running searches I think is required.
