suitable product for scanning files, folders on RHEL with no internet connectivity

Hi Kumar Bavandla,

Thanks for reaching out to the Sophos Community Forum. 

Related to your questions, it may be best for you to connect with one of our Sophos Sales Engineers so more in-depth answers can be provided. I will try my best to provide some information and resources below. 

1. A direct network connection to the internet is not necessary. However, the Linux system will need to communicate with an Update Cache&Message Relay. The UC/MR will need to reach Sophos Central. This can be accomplished by ensuring the necessary domains/ports are whitelisted for this UC/MR system.
   
   
2. When unknown/new files are encountered, some file telemetry will be sent to Sophos Central and Sophos Labs to check against the latest threat detection data. This communication will pass through the UC/MR.
   
   
3. If you have a Sophos XDR License, data will regularly be queried from the system. Additional information on the data fields can be found at the following link. If you don't have an XDR License, this will not be relevant and the data sent to Sophos Central will be minimal/related to events and detections.
   - https://docs.sophos.com/central/References/schemas/index.html?schema=xdr_schema_docs
   
   
4. Sophos Protection Linux offers on-access/signature-based scanning and runtime detection. The following link provides some information.
   - https://docs.sophos.com/esg/spl/en-us/help/ServerProtectionAgentTestDetectionFeatures/index.html
   
   
5. It is possible to perform an on-demand scan locally if a system is disconnected from the internet. The device must be brought back online to update either by connecting to the UC/MR to update or via other means.

Much of the appeal of Sophos Central is the ability to manage and monitor your environment from the web. In an ideal situation, the Update Cache and Message Relay will be used to maintain this connection so that you are immediately aware of any security concerns/detections. 

Please feel free to reach out to me via private message, and I can help connect you with your regional Sales Engineering team.

Another solution which will allow for more granular configuration and setup, is "SAV-DI". This solution is only available to OEM's at the moment, but if you would like to be put in touch with our OEM team to discuss implementation, do let me know.

Hi Kumar Bavandla,

Thanks for reaching out to the Sophos Community Forum. 

Related to your questions, it may be best for you to connect with one of our Sophos Sales Engineers so more in-depth answers can be provided. I will try my best to provide some information and resources below. 

1. A direct network connection to the internet is not necessary. However, the Linux system will need to communicate with an Update Cache&Message Relay. The UC/MR will need to reach Sophos Central. This can be accomplished by ensuring the necessary domains/ports are whitelisted for this UC/MR system.
   
   
2. When unknown/new files are encountered, some file telemetry will be sent to Sophos Central and Sophos Labs to check against the latest threat detection data. This communication will pass through the UC/MR.
   
   
3. If you have a Sophos XDR License, data will regularly be queried from the system. Additional information on the data fields can be found at the following link. If you don't have an XDR License, this will not be relevant and the data sent to Sophos Central will be minimal/related to events and detections.
   - https://docs.sophos.com/central/References/schemas/index.html?schema=xdr_schema_docs
   
   
4. Sophos Protection Linux offers on-access/signature-based scanning and runtime detection. The following link provides some information.
   - https://docs.sophos.com/esg/spl/en-us/help/ServerProtectionAgentTestDetectionFeatures/index.html
   
   
5. It is possible to perform an on-demand scan locally if a system is disconnected from the internet. The device must be brought back online to update either by connecting to the UC/MR to update or via other means.

Much of the appeal of Sophos Central is the ability to manage and monitor your environment from the web. In an ideal situation, the Update Cache and Message Relay will be used to maintain this connection so that you are immediately aware of any security concerns/detections. 

Please feel free to reach out to me via private message, and I can help connect you with your regional Sales Engineering team.

Another solution which will allow for more granular configuration and setup, is "SAV-DI". This solution is only available to OEM's at the moment, but if you would like to be put in touch with our OEM team to discuss implementation, do let me know.