Zero Day Protection - Downloads & Attachments

Question

Hey guys, 
 
 I have v21 installed and noticed a few entries under the Zero Day Attachments and Downloads. 
 Some fantastic information in the reports and a bunch of screenshots of the documents / files and a desktop. 
 
 Question: How is Sophos XGS taking a snapshot of the users desktop? We do not use the Sophos Endpoint agents and no other Sophos software installed.

Love it but curious.....

Michael Dunn · Accepted Answer

A copy of the file is sent to sophos servers where two types of analysis take place - static and dynamic. The dynamic analysis starts a VM and executes the file, then watches the behavior (for example does it modify the registry, make external connections, etc). This analysis can take a few minutes. Screenshots are made of the VM. More information can be found in this post: 
 community.sophos.com/.../sophos-firewall-sophos-sandstorm-zero-day-protection---more-data-than-ever-before

LuCar Toni · Answer

It is a Sandbox hosted at Sophos and not a user machine.

Zero Day Protection - Downloads & Attachments

Top Replies