Getting Started

Accessing the AI Assistant

1. Open Sophos Central and navigate to the Threat Analysis Center

2. Go to the Cases page and select (or create) a case.

   • Note: AI features aren't available for Sophos-managed MDR cases.

3. Open the AI Assistant Tab to begin interacting through the chat-like interface.

The Basics

Starting the Investigation

• When a new thread is created, the AI Assistant automatically collects the relevant case information and detections to establish the current context.

• You'll notice some prompts in the AI Assistant tab.

• Click any prompt to populate the chat box and then run it.

• Examples: "What actions can I perform?" "Show impacted endpoints," "Analyze suspicious command lines."

Custom Prompts

• Type your own request in plain English—no special syntax needed.

• Example: "Check for processes communicating with IP 10.0.1.108 on any endpoint in the past 24 hours."

Context-Aware

• The Assistant remembers your previous queries in the current thread.

• Ask follow-up questions based on earlier results (e.g., "Is that device online?" or "Who was logged in at that time?").

Core Use Cases

Triage & Investigation

• Example Prompt: "List all relevant observables (systems, IPs, files) in this case and explain why they're suspicious."

• The Assistant will identify impacted devices, malicious file hashes, etc.

Threat Intelligence Lookups

• Example Prompt: "Check the reputation of <https://malicious.url.>"

• Integrates with SophosLabs Intelix for real-time threat scoring.

Endpoint Status & Queries

• Example Prompt: "Fetch device management status for endpoint ENDPOINT-01."

• This reveals the device's health, licensing status, last seen date, and more.

Data Lake Queries

• Example Prompt: "Show me all processes connecting to 10.0.1.108 from 2 days ago until now."

• Retrieves historical logs, even if the endpoint is offline.

Case Summaries

• Example Prompt: "Generate an executive summary of this investigation."

• Produces a high-level report of detections, correlated events, and recommended actions.

Best Practices & Tips

Keep Queries Simple and Specific

• The AI Assistant excels when you focus on a single question or task per prompt.

Use Predefined Prompts for Common Tasks

• If you're unsure where to start, the built-in prompts can guide you—especially for standard queries like listing endpoints or generating a quick case overview.

Combine Queries to Drill Down

• First, ask for broad context (e.g., "Summarize suspicious activity over the last 24 hours").

• Then, refine with follow-up prompts (e.g., "Show me processes associated with that suspicious IP.").

Validate Suspicious Findings

• Though the AI Assistant aggregates multiple threat intel sources, it can occasionally flag false positives.

• Always cross-verify critical results or run multiple queries to confirm the threat level.

Feedback & Continuous Improvement

• If the AI Assistant's response seems off, use the built-in feedback mechanism. Your inputs help refine future responses.

Advanced Features

Live Endpoint Queries

• For urgent cases, you can run "canned queries" that retrieve fresh, real-time data from online endpoints (e.g., process trees, scheduled tasks, or file journaling).

Staleness Check

• The platform won't run live queries on endpoints not seen in the last 3 days unless you override that setting.

• Helps avoid delays when querying machines likely to be offline.

Historical Data Lake Investigations

• If you need older data (e.g., 2 weeks or 2 months ago), rely on the Data Lake queries. They search archived logs for deeper hunts and correlation.

No Results Returned?

• Check your filters (e.g., IP, username), or expand the time range.

• The system may be skipping stale endpoints or ignoring invalid parameters.

Large Queries

• Extremely broad queries might be truncated to avoid overwhelming the Assistant.

• Narrow the scope by specifying more precise fields or shorter time windows.

Next Steps

Explore Additional Queries

• Try advanced prompts like searching for suspicious file patterns or analyzing Windows scheduled tasks.

• Combine threat intel lookups with data lake or live endpoint queries for a holistic view.

Visit the Sophos Community

• If you hit a snag, the Sophos Community offers discussions, FAQs, and direct community support.

Provide Internal Training

• Share an internal knowledge base article or run short sessions to teach colleagues how to leverage the AI Assistant.

• Encourage them to ask natural-language questions for a faster learning curve.

Terms

This section has glossary of key terms and definitions that users might encounter while using the Sophos XDR AI Assistant.