Is there a way for a RMM to monitor for Sophos Endpoint restarts?

Question

I'm wondering if there is an Event Log or some file that can be monitored via a RMM product for endpoint restarts? I'm not sure if anyone has been able to accomplish this. 
 Right now, unless I look at the Events in Sophos Central I don't know if a machine needs a restart. I don't think the Sophos Endpoint restart notification creates the flag that most RMM's monitor for a restart. 
 Thanks.

Sophos User930 · Accepted Answer

Hello, A few things of note for when Sophos requires an update. SophosInterceptXCLI.exe "C:\Program Files\Sophos\Endpoint Defense\SophosInterceptXCLI.exe" query softwaremonitor updating --json | ConvertFrom-Json | ConvertTo-Json { "updating_details": { "download_state": "good", "install_state": "good", "reboot_required": "no", "updating_assessment": "good", "VersionInfo": [ "@{DisplayVersion=2025.1.0.536.0; Version=2025.1.0.536.0; name=Core Agent}", "@{DisplayVersion=2025.1.0.28.0 SPRINT 2024.51; Version=2025.1.0.28.0; name=Device Encryption}", "@{DisplayVersion=2023.2.0.3; Version=2023.2.0.3; name=Managed Detection and Response}", "@{DisplayVersion=2024.1.2.1.0; Version=2024.1.2.1.0; name=Sophos Intercept X}" ] } } I believe this tool is the supported way to get to the "latest" data under: HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SoftwareMonitor\Store\SoftwareMonitor e.g.: HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SoftwareMonitor\Store\SoftwareMonitor\20250213174410301433\ssm_updating Otherwise HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\AutoUpdate\UpdateStatus\VolatileFlags UrgentRebootRequired RebootRequired RebootRequiredSince Could be used VolatileFlags is a volatile reg key in that it is automatically removed on a reboot. This ensures it's always gone as it only exists in memory: new-item HKLM:\SOFTWARE\WOW6432Node\Sophos\AutoUpdate\UpdateStatus\VolatileFlags -Name test new-item : Cannot create a stable subkey under a volatile parent key.

Is there a way for a RMM to monitor for Sophos Endpoint restarts?

Top Replies