Hello yeowkm,

Information on Sophos Extensible List names Download reputation and MTD (Malicious Traffic Detection) lookups as reasons for lookups to 4.sophosxl.net. How (with which console) do you manage your endpoints?

Christian

my EC version is 5.5.

I do have HIP policies managing the endpoints.

what is the recommended settings for endpoints with no Internet access since they will always be trying to access 4.sophosxl.net externally

Hello yeowkm,

apparently your endpoints could have an internet connection. Normally the recommendations don't differ but as no connection is possible Live Protection can be turned off (which would also take care of these lookups).

If you observe just connection attempts to 4.sophosxl.net then it is perhaps MTD.

Christian

i stil have endpoints accessing 4.sophosxl.net after enabling the above mentioned steps 

Download reputation also uses SXL4.

Regards,

Jak

Hello yeowkm,

you've already said in your initial post that you did turn off Live Protection and this should take care of the connection attempts.
You do manage these endpoints with SEC and the endpoints comply with the policy?

Christian

will check the endpoints policy again.

probably not complying with the policy

thanks