This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Data Lake upload schedule for endpoints

There appears to be a delay between when an event happens on a server or endpoint and when I can run a live discover query on that data in the data lake. How long does it take for the Sophos agent to synchronize or upload it's data to the data lake?

This thread was automatically locked due to age.

0 Sophos User930 over 3 years ago

I think it depends on a couple of things:

1. The time it takes the events to be recorded and then flushed to the journal files to be interrogated if the data you expect is coming from a Sophos journal.
I believe this is 5 minutes.

2. The data in the data lake you are attempting to query and what the source is. If you look in the file:
C:\ProgramData\Sophos\Live Query\Queries\Packs\Latest\sophos-scheduled-query-pack.conf
you can see the queries and how they obtain the data and therefore where the data comes from, is it a Sophos extension or from the osquery data for example.

It also has the interval of the query in seconds.
Cancel
Vote Up 0 Vote Down

Cancel
0 Brian Ritchie over 3 years ago in reply to Sophos User930

Muhammad,

The XDR query pack logic is updated regularly behind the scenes and within the query packs, differing queries are staggered for upload to the data lake for hydration as mentioned by User930. Keep in mind the info maintained here as well on data storage limits as well:

https://docs.sophos.com/central/Customer/help/en-us/central/Customer/concepts/DataLakeStorageLimits.html

Brian Ritchie

Senior Solutions Engineer
Sophos Support Videos | Product Documentation | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel