Querying DNS data with Live Discover
One of the most common comments from EAP participants so far has been about the lack of visibility of DNS traffic data. The EAP refresh release coming in a week or two will help a lot with that, but in the meantime I thought I'd provide some examples…
[QueryCorner][October2023] Reviewing NSA and CISA Top 10 Misconfigurations
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Table of Contents
Background
1) Default Configurations…
[QueryCorner][June2023] Sophos Endpoint/Server - Auditing for Azure Code Signing Support
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
Microsoft announced a requirement for Azure Code Signing…
[QueryCorner][March2023] Deep Diving into OneNote Attacks
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Index
Purpose
Prerequisites
Query #1 - Live Discover - Check…
[QueryCorner][January2023] Live Discover - Network: Processes with an open network connection
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
If you have not traversed the XDR journals, please review…
[Sophos Firewall / Data Lake] Identify Attempts to Access Firewall by Country
SELECT
device_model,
--device_serial_id,
--app_name AS ProtoPort,
--in_interface,--
--src_mac,--
src_ip,
dst_ip,
src_country,
log_type AS Source_Log,
log_subtype AS Decision,
src_port,
dst_port
--protocol--
FROM xgfw_data
…
[QueryCorner][October2022] Audit Application Control
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
Sophos Endpoint and Server products all come equipped with…
[QueryCorner][October2022] Audit Peripheral Control
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
Sophos Endpoint and Server products all come equipped with…
[QueryCorner][October2022] Deep Diving into Windows Firewall
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
The Windows Firewall is a security component to help protect…
[QueryCorner][September2022] Live Discover - Program Execution Evidence
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
This query is taken directly from the Sophos Rapid Response…
[QueryCorner][August2022] Deep Diving Into RDP
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
Often, Remote Desktop Protocol (RDP) sessions are used…
[QueryCorner][August2022] Live Discover - IOC Hunting
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
Let's revisit a query written by Kyle Seike - post can…
[QueryCorner][July2022] Windows PCI Audit Report
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
This query is designed to give you information required…
[QueryCorner][July2022] Live Discover Device Card - MacOS
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
This query is designed to give you a "Total Report" of…
[QueryCorner][June2022] Deep Diving Into Reboots
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
Rebooting a computer can be a delicate situation. It can…
[QueryCorner][May2022] Audit User and Group Activity
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
Our first post in the Query Corner is going to target User…
Getting Started With Sophos Live Discover Design Mode
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Overview
This post is going to cover setting up a user created…
Query Corner Announcement and Master Index
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Overview
Here at Sophos, we launched EDR into the endpoint platform…
Outbound SMB Traffic
I am trying to determine what process is generating outbound SMB traffic on a system. I can see the traffic in the firewall logs, but when I use the query below, nothing comes up. It doesn't matter which system I check, or whether I use port 137 or 445…
Live Discover: Query Cancelled: E Process SophosOsqueryExtension.exe exceeded 30% CPU limit
Hi,
I need this Live Response quickly, unfortunately Sophos Intercept X is aborting the Query.
What is this and how do I get to my data? I just want to use that product with a default query!
2022-03-31T14:29:22.937Z [ 9644: 8204] E Process SophosOsqueryExtension…
Sophos Live Discover Query for CISA Alert (AA21-1481)-Sophisticated Spearphishing Campaign-Cobalt Strike
Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
A recent inquiry from a Sophos Customer indicated that they wanted…
Windows Update Query
Hello - Does anyone have a query they have used to see if Windows Update is running on an endpoint?
Where can we get help for XDR Queries?
Hi,
it there a better place for discussing about Live or Data Lake Queries than the " Live Discover & Response Query Forum "?
There is not much resoponse there. Or should I contact support for special questions?
Regards
Datalake Performance Issues
Hi,
Does anyone else have issues with Datalake queries just timing out? It's been pretty unusable for us every since we turned on the function. We have around 15,000 endpoints on our Central environment so I wonder if it's just down to the sheer volume…
Windows Servers: Live discover and MTR not working. MCS Client: W (async) connection timeout, W [push]: error creating async stream: 0
MTR team wrote us that some of our servers cannot be managed by them.
This maybe in relation with this thread
But here is no 503 error in MCSClient.log and the client is green for MCS communication
There has been an other thread here also with…