Browse Live Discover and Response Queries by Category
Under Review

Determine is device(s) are in EAP

When a device is enrolled in Early Access, many of the Sophos service tags for registry keys go from RECOMMENDED to BETA.
Upon reviewing the results of this query, if any devices return with "data" : "BETA" - those devices are in the early access program. 
Query to run: 
"SELECT data FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Sophos\\AutoUpdate\\Service\\CloudSubscriptions\\Base\\tag'"
SpencerBrown
Parents

  • Hi Spencer,

    I was able to modify your query a little so only the Tag is returned. I had some trouble getting data returned when using the "LIKE" operator. 

    SELECT data AS 'UpdateConfig' FROM registry WHERE key='HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\AutoUpdate\Service\CloudSubscriptions\Base\' AND name='Tag'

Comment

  • Hi Spencer,

    I was able to modify your query a little so only the Tag is returned. I had some trouble getting data returned when using the "LIKE" operator. 

    SELECT data AS 'UpdateConfig' FROM registry WHERE key='HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\AutoUpdate\Service\CloudSubscriptions\Base\' AND name='Tag'

Children
No Data
Unfiltered HTML