Adjustment of the SOPHOS threat analysis

Question

Hi guys, 
 Is there a possibility to display the firewall data persistently in the threat analysis and not only via queries? 
 Where can I see in the Threat Analysis Center whether the data from the firewall logs was included in the detections? 
 Is it possible to display several queries in parallel in the Threat Analysis Center? So far it looks as if only the last query is displayed there. 
 Kind Regards 
 Daniel

Qoosh · Answer

Hi Daniel , 
 Thanks for reaching out to the Sophos Community Forum. 
 Regarding your questions: It is not possible to keep firewall data displayed persistently in the Threat Analysis Center. The data returned from the queries will only be displayed after each query is run. The Sophos XDR Query API may allow you more freedom to display this data as you wish. 
 Could you elaborate on this question? Do you mean in the Investigations tab, or Threat Graphs?: 
 Daniel Kleine-Moellhoff said: Where can I see in the Threat Analysis Center whether the data from the firewall logs was included in the detections? 
 The data returned from each query can only be displayed one at a time. Depending on the data you're trying to extract, it may be possible to join/merge the data returned from two different queries, however, this requires you to make changes to the query syntax.

Adjustment of the SOPHOS threat analysis

Top Replies