Thread Info
  • State Suggested Answer
  • Replies 10 replies
  • Answers 1 answer
  • Subscribers 4 subscribers
  • Views 1074 views
  • Users 0 members are here
Options

New AI Search option for ENDPOINT DATA is missing

AndyR

I see that the new AI Search with Detections & Endpoint Data was released yesterday to General availability. Unfortunately I'm only seeing the option to search Detections, there is no Endpoint Data available when I click the drop down.

We're licensed for Intercept X Advanced with XDR which I believe is a qualifying product.

I have been signed up to AI Search Early Access since day 1 but EndPoint Data has never appeared as an option for us.

I logged a ticket for this (02545953) and they suggested posting a comment here. I've uploaded a screenshot showing the missing Endpoint Data option and a HAR file to the support case.

Thanks any assistance.

Regards

Andy.

  • 0

    Hello  

    Thank you for contacting the Sophos Community Forum and providing detailed information, including your support case number, screenshot, and HAR file, regarding the missing Endpoint Data option in AI Search. We appreciate your diligence in troubleshooting this matter.

    Please refer to this information if that helps you. 

    Recommended Troubleshooting Steps

    Check Data Lake Upload Settings:

    • In Sophos Central, go to:
    • Global Settings > Data Lake Upload Settings
    • Ensure both Endpoint and Server Data Lake Upload are turned on.
    • If you’re using global templates, confirm a template isn’t overriding these settings.
    • Please refer to this article for reference: Intercept X Advanced with XDR updates.

    Early Access Program (EAP) Participation: 
    Our internal checks confirmed that joining the Early Access Program (EAP) for Endpoint or Server is required for the Endpoint Data option to appear in AI Search, even if you have the correct license.

    When you join the EAP for Endpoint or Server:
    The Endpoint Data option becomes available in the AI Search drop-down.

    When you aren’t enrolled in the EAP for Endpoint or Server:
    The Endpoint Data option isn’t visible.

    Let me know if you need any further help. 

    Regards, 
    Rutvik Chavda
    Global Digital Endpoint Security Engineer
    If a post solves your question, please use the "Verify Answer" button.

    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
    • 0 in reply to Rutvik Chavda

      Hi Rutvik,

      Many thanks for your reply, much appreciated. Did I misunderstand the announcement posted yesterday stating that AI Search with Detections and ENDPOINT DATA was Generally Available? I read that as not requiring participation in any Early Access program, was I mistaken or is the article incorrect?

      Looks like AI Search is the new default as old Search gets removed on 26th August according to the article. community.sophos.com/.../search-experience-with-ai.

      Andy

      • 0 in reply to AndyR

        Based on my understanding, we have both on the GA version. 
        My account (without the EAP) do see both data bases. 

        Could you leave the EAP for AI and try it again? 

        Do you use any kind of special license ? Master License or anything? 

        __________________________________________________________________________________________________________________

        • 0 in reply to AndyR

          Hello AndyR,

          You’re most welcome. 

          Please refer to this information if that helps you. 

          While the announcement states that AI Search with Detections and Endpoint Data has reached general availability and will become the default search experience after August 2025, the current Sophos FAQ still require enrollment in the New AI Features Early Access Program (EAP) to access Endpoint Data in AI Search.

          Please refer to this article: AI features FAQs, published on April 16, 2025. 

          Let me know if you need any further help. 

          Regards, 
          Rutvik Chavda
          Global Digital Endpoint Security Engineer
          If a post solves your question, please use the "Verify Answer" button.

          The New Home of Sophos Support Videos!  - Visit Sophos Techvids
          • 0 in reply to LuCar Toni

            Hi LuCar Toni,

            I've left the New AI Features EAP as suggested and can confirm that AI Assistant is now missing as an option on Threat Analysis Centre>Cases. Guessing the AI Assistant part is still only in EAP?

            Unfortunately I'm still only seeing Detections as an option on the AI Search dropdown, there is no EndPoint Data. Have tried in multiple browsers & Incognito but made no difference.

            I've joined the New AI Features EAP again and see that Cases>AI Assistant tab has returned. Unfortunately still no Endpoint Data is visible as a drop down on AI Search.

            As for licenses I'm "Intercept X Advanced with XDR" according to the licenses page.

            We're running a mixture of Endpoint Agent versions, have recently started testing FTS 2024.3.2.23.2 on some clients.

            I think the AI Features FAQ (last updated in April 2025) needs updating now that AI Search is generally available.

            Logged into Central with another user and still see no AI Search>Endpoint Data. Funnily enough I do see the New Feature popup window announcing the AI Search Feature is now available!

            A mystery why I'm not seeing the AI Search>Endpoint Data bit!

            Thanks.

            Andy.

            • 0 in reply to AndyR

              Yes, we found the reason internally and working on a fix. There is something wrong in the Backend. 

              Stay tuned. 

              __________________________________________________________________________________________________________________

              • 0 in reply to LuCar Toni

                Like LuCar called out, we are have identified the issue and working on a fix. You can use the following workarounds in the mean time:
                - Join the New Server Protection Features EAP
                - Join the New Endpoint Protection Features EAP

                Joining one of these EAPs will provide the ability to use AI Search for Endpoint data.

                Alternatively, you can continue using Search.

                • 0 in reply to Manish Hirwani

                  Hi Manish,

                  Thanks for the suggestion regarding New Endoint/Server EAP as a workaround. However, they dont seem particularly active as no new announcements for several years.

                  At this stage I'm content to wait for this to be fixed rather than join another EAP. This may change as we get closer to the removal of legacy Search.

                  Thanks.

                  Andy.

                  • 0 in reply to AndyR

                    This is now resolved, I can see Endpoint Data as an option in AI Search. Many thanks for fixing this.

                    Andy.

                    • 0 in reply to AndyR

                      Hello AndyR,

                      Thank you for letting us know! We're glad you can now see the Endpoint Data option in AI Search and that the issue has been resolved.

                      If you have any further questions or need assistance with other features, please don’t hesitate to contact us here on the community. we’re always happy to help.

                      We appreciate your engagement and feedback in the Sophos Community.

                      Regards, 
                      Rutvik Chavda
                      Global Digital Endpoint Security Engineer
                      If a post solves your question, please use the "Verify Answer" button.

                      The New Home of Sophos Support Videos!  - Visit Sophos Techvids