Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
If Sophos pre-defined queries aren't working, Sophos Support can help to ensure that data is uploaded from your devices to the Sophos Data Lake. Visit the support portal
For custom query assistance, please see Getting LD&R Community Support or contact Sophos Professional Services.
For more information on Live Discover, please check out our Product Documentation

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • What if I installed after the breach happened? Hunting through windows event logs

    Karl_Ackerman
    • Events
    • Approved on
    • 0 Comments
    REVIEWED by Sophos If you are in a situation where you installed the CIXA-EDR product after a breach has already happened or is underway you will not have any of the sophos journals to hunt through for how the breach happened. Without the recorded history...

  • List of RDP Sessions in last N Days

    Karl_Ackerman
    • Events
    • Approved on
    • 0 Comments
    REVIEWED by Sophos This query takes a variable called 'Days to look back from now' and searches the windows event logs for evenit ID 1149 then uses JSON extract to get the username and remote IP address info for the remote terminal sessions. SELECT...

  • Check version of Notepad++ installed vs latest available

    AndrewMundell
    • Device
    • Approved on
    • 0 Comments
    REVIEWED by Sophos Followup to the Firefox query, repeating the process for Notepad++. SQL published at https://gist.github.com/andrewmundellsophos/17ea7cd7614fc61c3046e64586c4186b and pasted below: --Tested and working as of 2020-07...

  • Find Domain Controllers

    j0hnV
    • Device
    • Approved on
    • 0 Comments
    REVIEWED by Sophos SELECT os_version.name os_name, services.name, services.display_name, services.start_type, services.path, services.status, services.user_account FROM services JOIN os_version WHERE services.name = 'NTDS' To only find machines...

  • Live Discover Query - That nasty Microsoft DNS bug - SigRED a.k.a CVE-2020-1350

    AzRoN
    • Threat Hunting
    • Approved on
    • 1 Comment
    REVIEWED by Sophos As the title says, Microsoft recently advised a of a nasty bug within MS DNS servers. NakedSecurity has a great write up with suggested actions, PATCH NOW. Or implement a work around. https://nakedsecurity.sophos.com/2020/07/15...

  • Live Response read text files; change configuration files etc.

    Giu
    • Live Response
    • Under Review on
    • 2 Comments
    Hello 99% of my time I use the GUI; so when it comes to use the CMD prompt I feel a little uncomfortable I am trying to use live response; in the kb and other documentation it is stated that with Live Response on windows you can: Reboot a device that...

  • List software installed between two dates

    MichaelCurtis
    • Device
    • Approved on
    • 1 Comment
    REVIEWED by Sophos This query will list all the software installed between two dates, taking Sophos out of the list. The variable screen is below. It also shows the format. Some software has no date so that is returned just in case it helps SELECT...

  • Check for conflicting windows security software

    j0hnV
    • Device
    • Approved on
    • 1 Comment
    REVIEWED by Sophos Customers confronted with unexplainable red statusses and installation/update issues were helped by this: ------- select * FROM windows_security_products WHERE name is not 'Windows Firewall' and name is not 'Microsoft Defender...

  • Check version of Firefox installed vs latest available

    AndrewMundell
    • Device
    • Approved on
    • 0 Comments
    REVIEWED by Sophos A quick and dirty query leveraging curl to get the latest version of Firefox from Mozilla.org and compare to the installed version. Uses curl a bit too much, but I'm having trouble using "with" clauses and parsing that result, hopefully...

  • BitLocker Status

    MichaelCurtis
    • Device
    • Approved on
    • 0 Comments
    REVIEWED by Sophos A query that will return the BitLocker status of an Endpoint SELECT device_id,drive_letter,percentage_encrypted, encryption_method, version, persistent_volume_id, CASE conversion_status WHEN 1 THEN 'Fully Encrypted' WHEN 2 THEN...
Unfiltered HTML