Sophos Central Threat Detection Dashboard \Detection view

Hello together,
are you aware of any problems with Sophos Central?

I am asking because there are no more entries in the XDR under Threat Protection\Dashboard\ Detection since today.
Datalake and Live Response are unchanged and still set to active.
Queries via Live Discovery are also successful and up-to-date, and Live Response is functional.

Licences are also in the green zone.

In the past few days, there has been a malfunction in the Scheduled Reports from Central. However, the last report was created last night without any adjustments being made.

Nothing is listed under Sophos Status and on the Sophos Community website either.

I am really appriciate any helpful information, because XDR is quite important for us.
Thank you very much.

Top Replies

Michael Zebrowski - Admin 9 days ago in reply to GlennSen +1

We are experiencing this as well. Windows Event detections are no longer showing up on Threat Analysis Center > Detections. Live queries for same info are also not returning results. This outage started…

Parents

0 Jonas Stadler 4 days ago
A brief summary from my side:

Sophos support informed me, that the following detections (in the detecion-view) were deprecated on November 6:

WIN-EVENT-4625: Failed login attempt

WIN-EVENT-4698: Scheduled task created

WIN-EVENT-4738: User account changed

WIN-EVENT-4780: ACL set on admin account

WIN-EVENT-4720: User account created

WIN-EVENT-4726: User account deleted

WIN-EVENT-4740: User account locked out

WIN-EVENT-4737: Security enabled group change

WIN-EVENT-4735: Security enabled group change

WIN-EVENT-4765: SID history failed to be added to the account

( Marcel Can you confirm this? )

I don´t understand the point of irreversible removing Detections from the "Detection" view for all customers, if each customer has the option to suppress "noisy" detections independently.

Furthermore, I don't agree with the decision that customers were not informed about this change. I hope that Sophos will change this process in the future.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 Marcel 1 hour ago in reply to Jonas Stadler

I have created a Live Discover query based on the list that Jonas posted above. This query uses the Data Lake as source so it would generate a list similar to what you would see previously in the detections view.

To use the query go into Live Discover then toggle the Designer Mode and then click Create new query. In the screen that is shown next give the query a name, select Data Lake as the source and then copy the contents of the query below in the SQL box. After doing so you can run the query and it should show the events.

WITH events (DateTime, Who, Event, Device) AS (

   SELECT
      calendar_time,
      target_domain || '\' || target_username,
      CAST(eventid AS VARCHAR(8)) || ' - Invalid logon.',
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_invalid_logon'
     AND target_username <> '-'
   
   UNION ALL
   
   SELECT
      calendar_time,
      target_domain || '\' || target_username,
      CAST(eventid AS VARCHAR(8)) || ' - Account locked out.',
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_user_account_locked_out'
      
   UNION ALL
   
   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - Created user: ' || target_domain || '\' || target_username,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_user_account_created'
   
   UNION ALL

   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - Modified user: ' || target_domain || '\' || target_username,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_user_account_changed'
   
   UNION ALL
   
   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - Deleted user: ' || target_domain || '\' || target_username,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_user_account_deleted'

   UNION ALL
   
   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - Modified security group: '  || target_domain || '\' || target_username,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_security_enabled_grp_change_dc'
   
   UNION ALL

   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - Created Task: ' || task_name,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_scheduled_task_created'
   
   UNION ALL
   
   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - Modified Admin ACL: ' || target_domain || '\' || target_username,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_acl_set_on_admin_accounts_dc'

   UNION ALL
   
   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - SID history failed: ' || target_domain || '\' || target_username,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_sid_history_failed_adding_to_account_dc'
   
)

SELECT * FROM events ORDER BY DateTime DESC

Reply

0 Marcel 1 hour ago in reply to Jonas Stadler

WITH events (DateTime, Who, Event, Device) AS (

   SELECT
      calendar_time,
      target_domain || '\' || target_username,
      CAST(eventid AS VARCHAR(8)) || ' - Invalid logon.',
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_invalid_logon'
     AND target_username <> '-'
   
   UNION ALL
   
   SELECT
      calendar_time,
      target_domain || '\' || target_username,
      CAST(eventid AS VARCHAR(8)) || ' - Account locked out.',
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_user_account_locked_out'
      
   UNION ALL
   
   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - Created user: ' || target_domain || '\' || target_username,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_user_account_created'
   
   UNION ALL

   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - Modified user: ' || target_domain || '\' || target_username,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_user_account_changed'
   
   UNION ALL
   
   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - Deleted user: ' || target_domain || '\' || target_username,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_user_account_deleted'

   UNION ALL
   
   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - Modified security group: '  || target_domain || '\' || target_username,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_security_enabled_grp_change_dc'
   
   UNION ALL

   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - Created Task: ' || task_name,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_scheduled_task_created'
   
   UNION ALL
   
   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - Modified Admin ACL: ' || target_domain || '\' || target_username,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_acl_set_on_admin_accounts_dc'

   UNION ALL
   
   SELECT
      calendar_time,
      subject_domain || '\' || subject_username,
      CAST(eventid AS VARCHAR(8)) || ' - SID history failed: ' || target_domain || '\' || target_username,
      meta_hostname
   FROM xdr_data
   WHERE query_name = 'windows_event_sid_history_failed_adding_to_account_dc'
   
)

SELECT * FROM events ORDER BY DateTime DESC

Children

No Data