Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
If Sophos pre-defined queries aren't working, Sophos Support can help to ensure that data is uploaded from your devices to the Sophos Data Lake. Visit the support portal
For custom query assistance, please see Getting LD&R Community Support or contact Sophos Professional Services.
For more information on Live Discover, please check out our Product Documentation

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • vulnerability_fontblocking

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_fontblocking Schema analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write...

  • vulnerability_disallowed_paths_item_data

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    Additional info for disallowed paths SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_disallowed_paths

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    Detect disallowed paths, need to get a definition of such from MRT SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long...

  • vulnerability_developer_mode

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    Detect developer mode SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write ...

  • vulnerability_dep

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_dep SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write name...

  • vulnerability_certificate_padding

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    Certificate padding vulnerability SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_audit_special_groups

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_audit_special_groups Schema analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_applocker_ruleset_enforcement_mode

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    well its a vulnerability need to get descriptions of each of these vulnerabilities into the documentation. SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string...

  • vulnerability_app_mitigation_options

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    Not sure what this is detecting have to check with the Sophos Managed Threat Response Team on it. SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name...

  • vulnerability_app_disabled_exception_chain_validation

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    Detect disabled exception chain validation. https://www.windowsworkstation.com/win2012/disable-sehop/ SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string ...
Unfiltered HTML