Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
If Sophos pre-defined queries aren't working, Sophos Support can help to ensure that data is uploaded from your devices to the Sophos Data Lake. Visit the support portal
For custom query assistance, please see Getting LD&R Community Support or contact Sophos Professional Services.
For more information on Live Discover, please check out our Product Documentation

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • Data Lake Query similar to Endpoint File Access History

    Vern Severight
    • Data Lake
    • Under Review on
    • 3 Comments
    Is there a query available for the data lake to query file information similar to the File Access History that endpoint queries use? We would like to be able to query our data lake and find copied / modified / moved / deletions / re-naming & what it...

  • XDR Query - Get OS Buildnumber with Patchlevel

    Bernhard Weitlaner
    • NDR Queries
    • Under Review on
    • 3 Comments
    Hello Community, is it possible to get the full os build number inclusive patchlevel (windows) with a XDR Query or other way? There is a query named "Hardware and operating system details" but with this query i only get the os_version and build, for...

  • NDR detection

    Shay Hanya
    • NDR Queries
    • Under Review on
    • 1 Comment
    Hi I installed NDR appliance in my network, and I'm getting this messages: NDR-DET-DDE-MACIPHOSTNAMECORRELATION "Source MAC address, IP address, and Hostname correlation based on MDNS and NetBIOS" The detection in low severity. Any idea...

  • Custom curl query?

    Andrew Bishop
    • Other queries
    • Under Review on
    • 8 Comments
    Does anyone know of or have a custom live discover query that can identify any processes, programs running cURL? I am seeing something to help identify the vulnerability located in CVE-2023-38545. Description The version of curl installed on the remote...

  • Is there a way to check what applications are installed on MAC endpoints via Sophos Central?

    Subash Chandran
    • Device
    • Approved on
    • 1 Comment
    Is there a way to check what applications are installed on MAC endpoints via Sophos Central? I can see queries to pull-out installed application list from Windows endpoints. Is there any query for MAC endpoints

  • Create Custom Query and Run on Endpoints

    Dilip Devadas
    • Data Lake
    • Under Review on
    • 2 Comments
    Hello, I would like to run this command on all devices and extract as periodic report using Query from endpoint thru Sophos Cental. Command wmic bios get serialnumber, hostname

  • Live Discover - Patches Applied (Windows)

    Selvinen VENCATAKISTNEN
    • Compliance
    • Complete on
    • 1 Comment
    Hello, The current query for "Patches applied" lists all the patches applied, but does not include patches applied via MSI or downloaded from Windows Update. Query: SELECT hotfix_id, description, installed_by, installed_on FROM patches Is...

  • Domains (FQDNs) to allow for Live Discover (for MDR team)

    BoreasJeff
    • Network
    • Under Review on
    • 5 Comments
    What are the domains or FQDNs to allow for access to Live Discover? The goal is to allow the Sophos MDR team to access an endpoint that is in red status and getting blocked by the firewall. When a device behind the Sophos firewall goes into a red...

  • Using Live Response to investigate Sophos Services & their CPU utilization

    Bhaumik Gohel
    • Live Response
    • Approved on
    • 0 Comments
    Initial Steps: The given Powershell script will run from Live Response as well as from powershell prompt. There's no obligation to have elevated privilege to run this script. After opening command prompt enter "powershell" Copy paste the complete...

  • Find only new created files by extension

    LHerzog
    • Files
    • Under Review on
    • 1 Comment
    Hi, I did a copy of the default live query: File access history I'm only interested in new files that have been created in that timeframe. The demand is a bit like the default " New applications deployed " query. But not only for applications. ...
Unfiltered HTML