Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
If Sophos pre-defined queries aren't working, Sophos Support can help to ensure that data is uploaded from your devices to the Sophos Data Lake. Visit the support portal
For custom query assistance, please see Getting LD&R Community Support or contact Sophos Professional Services.
For more information on Live Discover, please check out our Product Documentation

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • windows_event_dos_attack_detected

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_dos_attack_detected SCHEMA description string Plugin description text eventid int The Windows event ID provider_name string The Windows event provider source string The Windows event source ...

  • windows_event_disallowed_credentials

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_disallowed_credentials SCHEMA cred_type string Types of credentials which were presented for delegation description string Plugin description text eventid int The Windows event ID package string...

  • windows_event_audit_policy_changed

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_audit_policy_changed SCHEMA audit_policy_changes string Changes that were made. category string The name of auditing Category which subcategory was changed. description string Plugin description text ...

  • windows_event_audit_log_cleared

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_audit_log_cleared SCHEMA description string Plugin description text eventid int The Windows event ID provider_name string The Windows event provider source string The Windows event source ...

  • vulnerability_weak_algorithms

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_weak_algorithms SCHEMA data string Data content of registry value key string Name of the key mtime long time of the most recent registry write name string Name of the registry value entry ...

  • vulnerability_unrestricted_paths_item_data

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_unrestricted_paths_item_data SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent...

  • vulnerability_unrestricted_paths

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_unrestricted_paths SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_uac_disabled

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_uac_disabled SCHEMA data string Data content of registry value key string Name of the key mtime long time of the most recent registry write name string Name of the registry value entry path...

  • vulnerability_srp_transparent

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_srp_transparent SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write...

  • vulnerability_srp_exclude_local_admin

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_srp_exclude_local_admin SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...
Unfiltered HTML