Sophos Community
User
Site
Search
User
Toggle Mobile menu
Community & Product Forums
Blogs
Partners
Events & Webinars
Getting Started
Support Portal
Community Blogs
Application Control
Community
Product documentation
Security
Feedback
Support Portal
Product documentation
Products
Endpoint security
Sophos Endpoint
Sophos XDR
Sophos Mobile
Network Security
Sophos Firewall
ZTNA
Sophos Switch
UTM Firewall
Sophos Wireless
NDR
Email Security
Sophos Email
Phish Threat
Cloud Security
Sophos Central
Sophos Cloud Optix
Support Tools
Sophos integrations
Free tools
Services
Management platform
Sophos Central
Support Portal
Sophos Community log in
Sophos Partners
Partners blog
Local Partner community
Partner news
Resources
MSP guides
Partner Care
Sophos Central
Webinars & Events
Webinars & Events
Calendar
Become a partner
Join our program
Events & Webinars
Events & Webinars
Calendar
Recordings
Getting started in the Community
How to get started
SophosID registration
How to set up your profile
How to contribute and participate
How to manage private messages
Member recognition
Rewards program
Leaderboard
Products and Services
Products
Endpoint security
Sophos Endpoint
Sophos XDR
Sophos Mobile
Network Security
Sophos Firewall
ZTNA
Sophos Switch
UTM Firewall
Sophos Wireless
NDR
Email Security
Sophos Email
Phish Threat
Cloud Security
Sophos Central
Sophos Cloud Optix
Support Tools
Sophos integrations
Free tools
Services
Management platform
Sophos Central
Support Portal
Sophos Community log in
Blogs
Community Blogs
Application Control
Community
Product documentation
Security
Feedback
Support Portal
Product documentation
Partners
Sophos Partners
Partners blog
Local Partner community
Partner news
Resources
MSP guides
Partner Care
Sophos Central
Webinars & Events
Webinars & Events
Calendar
Become a partner
Join our program
Events & Webinars
Events & Webinars
Events & Webinars
Calendar
Recordings
Getting Started
Getting started in the Community
How to get started
SophosID registration
How to set up your profile
How to contribute and participate
How to manage private messages
Member recognition
Rewards program
Leaderboard
Support Portal
Guest User!
You are not Sophos Staff.
Sophos Endpoint
Cloud Optix
Release Notes & News
Discussions
Recommended Reads
Threat Hunting Academy
Early Access Programs
Live Discover & Response Query Forum
Calendars
More
Cancel
New
Sophos Endpoint requires membership for participation - click to join
Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.
New to Live Discover & Response queries? See
Getting Started In Live Discover - From Beginner to Advanced Query Creation
Make sure to also check out
Best Practices On Using Live Discover & Response Query Forum
and
Sophos EDR Threat Hunting Framework
.
Note:
For more information on Live Discover, please check out our
Product Documentation
.
Navigate to a category below to browse and submit a query
Browse Live Response and Discover Queries by Category
Uncategorized
Anomalies
ATT&CK
Compliance
Device
Email
Events
Files
Live Response
Network
Other queries
Processes
Query Tips
Registry
Threat Hunting
User
Data Lake
Browse Ideas in Category
By highest score
By date
By recent status change
Descending
Ascending
All ideas
Ideas you submitted
Ideas you voted on
With any status
With any open status
With any closed status
With held votes
Currently 'Completed (Brand-new content)'
Currently 'Completed (Content Update)'
Currently 'Completed (Minor Issue)'
Currently 'Approved'
Currently 'Under Review'
Currently 'Coming Soon'
Currently 'Not Planned'
Currently 'Complete'
No matching ideas found
