Sophos Heartbeat At risk

Hi AndersK, 

I have moved this thread to the intercept X forum to investigate if the issue lies with the endpoint or not. Can you please share a screenshot of the device status shown on the endpoint agent and Sophos Central? Also, when was the device's last activity reported on Sophos Central?

Hi Yashraj,

Thank you. Please see screenshots below. I don't have access to this endpoint now but have attached health status from the registry. Earlier this morning the agent showed the green check on the endpoint and seems to check in with Sophos Central correctly. This endpoint showed green health last week and red the week before.

Regards, Anders

if you have access to those devices again check the log here:

C:\ProgramData\Sophos\Heartbeat\Logs

Look for "Sending network status. Active Interfaces:" do you have changing interfaces there? Maybe caused by more aggressive energy saving features on the T14s

I could also imagine different network adaters or virtual adapters on the T14s not working properly with heartbeat.

sorry, I did'nt read your initial post properly. This does'nt look like energy saving issues (Connection closed (network error))

I've opened a support case today and will be onsite tomorrow for more investigation. It seems to choose the correct network adapter, but Sophos agent is sending health 3 although no problems are visible in the interface. Endpoints are usually stuck as "at risk" for some days and then go back to green, but there's no flapping between red-missing-green. I've tried disabling power saving on the ethernet adapter and also disabled power saving 802.az EEE on the switches but it makes no difference.

Heartbeat.log

a 2021-05-24T08:05:25.367Z [6284:22556] - Sending health status: {"health":3}

Hi AndersK,

Could you please provide the case number to update it with the information shared in this thread?

Hi AndersK,

Could you please provide the case number to update it with the information shared in this thread?

Hi Yashraj,

Sophos Support Case 04027645

Regards, Anders

We are experiencing a similar issue. Our devices are Lenovo ThinkPad 14 & Thinkbook 13s, stuck each day for hours "at risk".

Was there any update to this issue?

a 2021-05-25T07:01:09.147Z [5168:6608] - Connection closed (network error).
a 2021-05-25T07:01:10.180Z [5168:6608] - Connection succeeded.
a 2021-05-25T07:01:10.180Z [5168:6608] - Connected to 'd5340c68-99e5-439b-8429-95cd57919e88' at IP address 52.5.76.173 on port 8347
a 2021-05-25T07:01:10.192Z [5168:6608] - Sending network status. Active Interfaces:
MAC: 48:2A:E3:9A:70:44 - INET: 192.168.96.131 - INET6:
a 2021-05-25T07:01:10.229Z [5168:6608] - Received request to enable enhanced application control
a 2021-05-25T07:01:10.230Z [5168:6608] - Sending login status.
a 2021-05-25T07:01:13.690Z [5168:6608] - Sending health status: {"admin":1, "health":1, "service":1, "threat":1}
a 2021-05-25T07:03:59.780Z [5168:6608] - Received request to disable enhanced application control for C:\program files (x86)\microsoft\edge\application\msedge.exe
a 2021-05-25T07:54:17.028Z [5168:5656] - ----------------------------------------------------------------------------------------------------
a 2021-05-25T07:54:17.031Z [5168:5656] - Stopped Heartbeat
a 2021-05-25T07:54:17.031Z [5168:5656] - ----------------------------------------------------------------------------------------------------

a 2021-05-25T07:54:19.858Z [13220:14304] - Starting Heartbeat version 1.11.194.0
a 2021-05-25T07:54:19.858Z [13220:14304] - ----------------------------------------------------------------------------------------------------
a 2021-05-25T07:54:19.882Z [13220:3992] - Connection succeeded.
a 2021-05-25T07:54:19.882Z [13220:3992] - Connected to 'd5340c68-99e5-439b-8429-95cd57919e88' at IP address 52.5.76.173 on port 8347
a 2021-05-25T07:54:19.901Z [13220:3992] - Sending network status. Active Interfaces:
MAC: 48:2A:E3:9A:70:44 - INET: 192.168.96.131 - INET6:
a 2021-05-25T07:54:19.926Z [13220:3992] - Received request to enable enhanced application control
a 2021-05-25T07:54:19.927Z [13220:3992] - Sending login status.
a 2021-05-25T07:54:19.937Z [13220:3992] - Sending health status: {"health":3}
a 2021-05-25T09:19:55.924Z [13220:3992] - Received request to disable enhanced application control for C:\program files (x86)\microsoft\edge\application\msedge.exe

Thank you, I'll keep an eye on this ticket. Please PM me if you need anything else. 

Hi Chris Constable,

Chris Constable said:

Sending health status: {"admin":1, "health":1, "service":1, "threat":1}

This suggests that there was a threat in your system. Are there are any outstanding alerts on Sophos Central? 

What is the current status of the endpoint is on the device and Sophos Central? Are you facing a similar issue as mentioned in this thread where the device is reported with Red status on Sophos (XG) Firewall and green on the device and Sophos Central? 

Hi Chris,

I’ve done some troubleshooting yesterday and today and on computers where the docking station firmware (ThinkPad Thunderbolt 3 Dock Gen 2)  has been updated to the latest version, the problem has cleared for now at least, but it will probably take a few days to see if this was the cause.

Yes, the device endpoint is reporting green and the device is green on Sophos Central. The XG firewall is reporting it "At Risk".

We are using "Lenovo ThinkPad USB-C Dock Gen2 (UK) 40AS0090UK", my colleague confirms it is up to date on version: April 13, 2021 (1.0.8.0.3231)

As an aside - in case anyone needs this information - if we bypass the networking on the docking station - the issue seems to resolve itself. We will monitor over the coming days, but initial signs look good.

I would suggest you open a support case at this stage and get an SDU from the affected machine. On the endpoint, go to the Sophos panel and click on About > Open Endpoint Self Help Tool > Launch SDU

With that, you can provide to support and they can look at the registry values and compare with your SFOS logs to see if this is a mismatch in reporting or if there is a value stuck in the registry.

It does look like this was a docking station issue. After upgrading the ThinkPad Thunderbolt 3 Dock and also the older ThinkPad Pro Dock firmware, the stuck in red health and also a green/missing flapping issue has all cleared. The first docking stations were upgraded two weeks ago and has been stable since.

Hi AndersK, 

Thanks letting us know. Please reach out if you face any further issues.