Sophos Enterprise Console doesn't logs any hash of malicious files detected by Sophos Endpoint agent

Hi Christian,

Well there are several reasons, let's start with some of them:

First of all, knowing the hash of the malicious detected files allows Analyst to run multiple analysis on the nature of the detected files. e.g. running query on VT or other OSint resources.

With the hash of the file is possible to use it as IOC and  scan with that the rest of enterprise assets.

I found the "family" for detected malware missing lot of information that might be useful for the incident response phase. 

There are cases in which suspicious files have been detected by Sophos as part of a specific new family of variant , and then hours later, the same file get detected as part of an old type of malware. I guess this is because in the meanwhile the signatures that detect that new variant have been tuned by Sophos; but from my perspective I'm playing with a black box.

Files get blocked or not by Sophos... That's it, we don't get that much information to run investigations on our end. 

Of course there are some cases in which the hash change and the value of that information might be less valuable. But I would say that those cases are still the minority, and also for these the hash can be relevant for the purpose of the investigation.

We all know that AV cannot be The only solution that keep an asset safe, but maybe if they work in a more transparent way, they can still provide lot of information for Incident Response.

Hi Christian,

Well there are several reasons, let's start with some of them:

First of all, knowing the hash of the malicious detected files allows Analyst to run multiple analysis on the nature of the detected files. e.g. running query on VT or other OSint resources.

With the hash of the file is possible to use it as IOC and  scan with that the rest of enterprise assets.

I found the "family" for detected malware missing lot of information that might be useful for the incident response phase. 

There are cases in which suspicious files have been detected by Sophos as part of a specific new family of variant , and then hours later, the same file get detected as part of an old type of malware. I guess this is because in the meanwhile the signatures that detect that new variant have been tuned by Sophos; but from my perspective I'm playing with a black box.

Files get blocked or not by Sophos... That's it, we don't get that much information to run investigations on our end. 

Of course there are some cases in which the hash change and the value of that information might be less valuable. But I would say that those cases are still the minority, and also for these the hash can be relevant for the purpose of the investigation.

We all know that AV cannot be The only solution that keep an asset safe, but maybe if they work in a more transparent way, they can still provide lot of information for Incident Response.