Hi All,
After joining the Early Access Program (EAP) for Enhanced Protection/ IPS and AMSI, the endpoint may report a Bad health state due to Sophos Snort service not starting until after a reboot.
A reboot is required to complete the install of the new IPS and AMSI components. This occurs in the Core Agent releases of 2.4.0 and will be fixed in the next release of the Core Agent in November 2019.
Related KB: https://community.sophos.com/kb/en-us/134781