Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
If Sophos pre-defined queries aren't working, Sophos Support can help to ensure that data is uploaded from your devices to the Sophos Data Lake. Visit the support portal
For custom query assistance, please see Getting LD&R Community Support or contact Sophos Professional Services.
For more information on Live Discover, please check out our Product Documentation

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • vulnerability_srp_default_level

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_srp_default_level SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_spectre_meltdown

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_spectre_meltdown SCHEMA count long Count of patches -- vulnerability_spectre_meltdown INFO SELECT -- Device ID DETAILS meta_hostname, meta_ip_address, -- Query Details query_name, count, -- Decoration...

  • vulnerability_sehop_validation

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_sehop_validation SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write...

  • vulnerability_sehop

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_sehop SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write ...

  • vulnerability_secureboot

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_secureboot SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write ...

  • vulnerability_safer_flags_not_enforcing

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_safer_flags_not_enforcing SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_safer_flags_missing

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_safer_flags_missing SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_outlook_flags

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_outlook_flags SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write...

  • vulnerability_opentype_font

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_opentype_font SCHEMA data string Data content of registry value key string Name of the key mtime long time of the most recent registry write name string Name of the registry value entry path...

  • vulnerability_kernel_null_page_access

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_kernel_null_page_access SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...
Unfiltered HTML