Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
If Sophos pre-defined queries aren't working, Sophos Support can help to ensure that data is uploaded from your devices to the Sophos Data Lake. Visit the support portal
For custom query assistance, please see Getting LD&R Community Support or contact Sophos Professional Services.
For more information on Live Discover, please check out our Product Documentation

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • Gather System Information

    JeramyKopacko
    • Device
    • Approved on
    • 2 Comments
    This query can be used for general IT. Perhaps a organization is considering new software or to compare serial numbers for warranty. SELECT uuid, hardware_serial, hostname, cpu_subtype, cpu_brand, printf("%.2f", CAST(system_info.physical_memory AS...

  • Find Local Administrative Accounts

    JeramyKopacko
    • User
    • Approved on
    • 1 Comment
    It may be useful to do a search for local administrative accounts in your device fleet. You could grab timestamps of when accounts were created to gain more insight. SELECT username, groupname, type, u.UID, g.GID, Description, comment FROM users u...

  • windows_wsl_installed

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_wsl_installed SCHEMA atime long Last access time ctime long Time of the change event filename string Name of the file that has changed mtime long time of the most recent registry write path string...

  • windows_updates_patch

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_updates_patch SCHEMA caption string Short description of the patch description string Plugin description text hotfix_id string The kb article ID for the update installed_by string The system context...

  • windows_startup_programs_md5

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_startup_programs_md5 SCHEMA core_file_info string Core file info file_size long File size now global_rep int The machine learning global reputation now global_rep_data string All global reputation data...

  • windows_startup_items

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_startup_items SCHEMA cmdline string Process command line name string Name of the registry value entry path string Full path to the value result string The authenticode signature of the startup item ...

  • windows_services_md5

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_services_md5 SCHEMA description string Plugin description text display_name string Service Display name name string Name of the registry value entry path string Full path to the value sha1 string...

  • windows_services_md5

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_services_md5 SCHEMA description string Plugin description text display_name string Service Display name name string Name of the registry value entry path string Full path to the value sha1 string...

  • windows_programs

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_programs SCHEMA identifying_number string Product identification such as a serial number on software, or a die number on a hardware chip install_date string Date that this product was installed on the system install_source...

  • windows_powershell_script_blocks

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_powershell_script_blocks SCHEMA script_block_count int The total number of script blocks for this script script_block_id string The unique GUID of the powershell script to which this block belongs script_name string...
Unfiltered HTML