About using the principle of intercept X and deployment way?
I guess this is covered in: https://community.sophos.com/products/intercept/f/information/92662/how-does-sophos-intercept-x-work