Endpoint IPS Module GA yet

Hi tallwood6 ,

Thank you for reaching out to the Sophos Community Forum.

The IPS functionality on Sophos Endpoint is still included in the New Endpoint Protection Features EAP. You can still join the program by navigating to the "Early access programs" on your Sophos Central, and select "New Endpoint Protection Features".

Once this is added to your device, you may also refer to the following article to test the IPS functionality: Sophos Endpoint IPS: Script for testing.

I have also inquired internally, and the IPS enablement is due in the core agent 2023.2 version, which is planned for the next few months, but a more definitive release date is not yet available.

Thanks that really handy to know, i guess i could try the EAP to test but will the IPS module look to block active recon e.g. port scans at the endpoint level?

I do not believe the IPS functionality has rules to block port scans. To date, it has been used to block command & control activity and the spread of malware (e.g., via SMB protocol).

Thanks thats really useful.