Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries? See Getting Started In Live Discover - From Beginner to Advanced Query Creation
Make sure to also check out Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.

Note: For more information on Live Discover, please check out our Product Documentation.

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Browse Ideas in Category

  • Query for System Reboots/Shutdowns

    JeramyKopacko
    • Approved on
    • 1 Comment
    Posted this for easier access as I am sharing it with another community user who looked for this functionality: SELECT DISTINCT eventid, CASE eventid WHEN '41' THEN 'Rebooted without clean shutdown' WHEN '1074' THEN 'Shutdown properly by user...

  • When was the last scan completed on the endpoint

    Karl_Ackerman
    • Approved on
    • 0 Comments
    Simple query to read the registry for the sophos scan status. SELECT substr(data, 1,4) YEAR, CASE CAST(substr(data, 5,2) AS INT) WHEN 1 THEN 'January' WHEN 2 THEN 'February' WHEN 3 THEN 'March' WHEN 4 THEN 'April' WHEN 5 THEN 'May'...

  • RDP Enrichment with AbuseIPDB Data

    Kris Wayman
    • Approved on
    • 0 Comments
    This is a great query to start enriching RDP telemetry from your environment. You will need to sign up for an account with AbuseIPDB ( https://www.abuseipdb.com/ ) and generate an API key to call in the query below. -- YOU NEED TO EDIT THIS AND ADD...

  • Remote Desktop | Terminal Services - Query server for brute force logins and geolocate where those logins are coming from.

    Brian Ritchie
    • Approved on
    • 0 Comments
    These 2 queries were developed to assist with running checks on RDP or Terminal servers run on Windows Server. They typically have port 3389 open and are vulnerable to brute force attacks. This is the most popular and easiest manner that hackers gain...

  • List of RDP Sessions in last N Days

    Karl_Ackerman
    • Approved on
    • 0 Comments
    REVIEWED by Sophos This query takes a variable called 'Days to look back from now' and searches the windows event logs for evenit ID 1149 then uses JSON extract to get the username and remote IP address info for the remote terminal sessions. SELECT...

  • Live Discover Query - Brute Force Activity

    Jordon Carpenter
    • Approved on
    • 1 Comment
    REVIEWED by Sophos Here is a query to identify activity that resembles brute force activity: SELECT eventid, JSON_EXTRACT(data, '$.EventData.SubjectUserName') AS subject_username, JSON_EXTRACT(data, '$.EventData.SubjectDomainName') AS subject_domain...

  • Another Story from the Front Line: Has CobaltStrike or PowerShellEmpire been installing services on the device

    Karl_Ackerman
    • Approved on
    • 0 Comments
    REVIEWED by Sophos Like the earlier post we are often helping an account after they have been breached and are needing to deploy InterceptX with EDR on devices that where breached. In these situations we can't depend on the Sophos Journals for our historic...

  • Intercept X Advanced, Server Event Logs

    AStaUK
    • Under Review on
    • 3 Comments
    I'm just getting started with Intercept X and when I was being demoed the product I'm sure one of the features I was shown was the ability to store the Windows Event Logs in the cloud. But so far I've not been able to achieve this or find any documentation...

  • What if I installed after the breach happened? Hunting through windows event logs

    Karl_Ackerman
    • Approved on
    • 0 Comments
    REVIEWED by Sophos If you are in a situation where you installed the CIXA-EDR product after a breach has already happened or is underway you will not have any of the sophos journals to hunt through for how the breach happened. Without the recorded history...

  • Retrieve user creation/deletion and password reset events from the sophos_windows_events table

    Marcel
    • Approved on
    • 0 Comments
    This query retrieves account creation, deletion and password reset events under Windows. You can specify the number of days you want to go back, which is specified in the variable Days (string). SELECT datetime(swe.time,'unixepoch') Date_Time, json_extract...

  • Live Discover Query - History of Safe Mode system startup

    Karl_Ackerman
    • Approved on
    • 1 Comment
    REVIEWED by Sophos We want a query to list the boot history of the device and if the boot was into safemode or not. SELECT CAST(datetime(time, 'unixepoch') AS TEXT) AS 'System Startup Date-Time', CASE JSON_EXTRACT(data, '$.EventData.BootMode') WHEN...

  • Live Discover Query - RDP history

    jak
    • Approved on
    • 5 Comments
    REVIEWED by Sophos As RDP is always a hot topic in the world of security, it might be helpful to gain a report of perhaps who is connecting to where. The default RDP client, mstsc.exe maintains a history of the computers connected to under the following...
Unfiltered HTML