suitable product for scanning files, folders on RHEL with no internet connectivity

Could some one help to answer these 
or help me to route to the appropriate support team?

Hi Kumar Bavandla,

Thanks for reaching out to the Sophos Community Forum. 

Related to your questions, it may be best for you to connect with one of our Sophos Sales Engineers so more in-depth answers can be provided. I will try my best to provide some information and resources below. 

1. A direct network connection to the internet is not necessary. However, the Linux system will need to communicate with an Update Cache&Message Relay. The UC/MR will need to reach Sophos Central. This can be accomplished by ensuring the necessary domains/ports are whitelisted for this UC/MR system.
   
   
2. When unknown/new files are encountered, some file telemetry will be sent to Sophos Central and Sophos Labs to check against the latest threat detection data. This communication will pass through the UC/MR.
   
   
3. If you have a Sophos XDR License, data will regularly be queried from the system. Additional information on the data fields can be found at the following link. If you don't have an XDR License, this will not be relevant and the data sent to Sophos Central will be minimal/related to events and detections.
   - https://docs.sophos.com/central/References/schemas/index.html?schema=xdr_schema_docs
   
   
4. Sophos Protection Linux offers on-access/signature-based scanning and runtime detection. The following link provides some information.
   - https://docs.sophos.com/esg/spl/en-us/help/ServerProtectionAgentTestDetectionFeatures/index.html
   
   
5. It is possible to perform an on-demand scan locally if a system is disconnected from the internet. The device must be brought back online to update either by connecting to the UC/MR to update or via other means.

Much of the appeal of Sophos Central is the ability to manage and monitor your environment from the web. In an ideal situation, the Update Cache and Message Relay will be used to maintain this connection so that you are immediately aware of any security concerns/detections. 

Please feel free to reach out to me via private message, and I can help connect you with your regional Sales Engineering team.

Another solution which will allow for more granular configuration and setup, is "SAV-DI". This solution is only available to OEM's at the moment, but if you would like to be put in touch with our OEM team to discuss implementation, do let me know.

To address the usecase needs you mentioned: 

Usecase:
a. Supported operating systems can be found here. Please see "System Requirements" -  https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html

b. On demand scanning is available by default. The NFS filesystem is supported - https://docs.sophos.com/esg/spl/en-us/support/ServerProtectionAgentFilesystemSupport/index.html#supported-filesystems

c. One Windows Server will need to be connected to the internet. The Linux systems will need to connect to the Windows system and nothing else. 

d. While this is not quite possible in the same capacity as you mention, devices do update regularly and can be disconnected from the internet when necessary. The UC/MR setup also alleviates this need.

e. To see scan results, you will need to enable verbose logging. Otherwise, the scanning processes will only log the detections. Files scanned that are not detected are not typically logged.

thank you for your responses. Sure, I will contact you for sales team details.

Just a clarification regarding (c), Sophos Central: Configure Update Caches and Message Relays - Sophos Techvids video (at 1:04 time) says that devices still need to connect to Central, could you clarify this ?

The point you mention is specific to an "Update Cache Only" setup without a Message Relay. In your situation, you will need to deploy both features.