Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 16 subscribers
  • Views 1191 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Data Lake upload schedule for endpoints

Muhammad Muaaz

There appears to be a delay between when an event happens on a server or endpoint and when I can run a live discover query on that data in the data lake. How long does it take for the Sophos agent to synchronize or upload it's data to the data lake?



This thread was automatically locked due to age.
Parents
  • 0

    I think it depends on a couple of things:

    1. The time it takes the events to be recorded and then flushed to the journal files to be interrogated if the data you expect is coming from a Sophos journal. 
    I believe this is 5 minutes.

    2. The data in the data lake you are attempting to query and what the source is.  If you look in the file:
    C:\ProgramData\Sophos\Live Query\Queries\Packs\Latest\sophos-scheduled-query-pack.conf
    you can see the queries and how they obtain the data and therefore where the data comes from, is it a Sophos extension or from the osquery data for example.

    It also has the interval of the query in seconds.

Reply
  • 0

    I think it depends on a couple of things:

    1. The time it takes the events to be recorded and then flushed to the journal files to be interrogated if the data you expect is coming from a Sophos journal. 
    I believe this is 5 minutes.

    2. The data in the data lake you are attempting to query and what the source is.  If you look in the file:
    C:\ProgramData\Sophos\Live Query\Queries\Packs\Latest\sophos-scheduled-query-pack.conf
    you can see the queries and how they obtain the data and therefore where the data comes from, is it a Sophos extension or from the osquery data for example.

    It also has the interval of the query in seconds.

Children
Unfiltered HTML