Query - Are any Sophos services not running?

 REVIEWED by Sophos 

Sometimes adversaries are able to stop Sophos services, or the endpoint has had an install or update issue.  As long as the live discover services are up an running you can find devices that do not have all the needed Sophos services running.

SELECT
   name,
   display_name,
   start_type,
   path,
   status,
   user_account
FROM services
WHERE (path like '%sophos%' or path like '%hitman%')
   AND status <> 'RUNNING';