In this draft document John Limb discusses the Sophos NDR solution and each of the components. The document is proceeding through final editing and an updated version will be available shortly.
The document covers each of the detection engines and includes a list of the understood protocols for the Sophos NDR Solution as of April 2023