Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
For more information on Live Discover, please check out our Product Documentation
For query assistance, please see Getting LD&R Community Support.

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • windows_updates_patch

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_updates_patch SCHEMA caption string Short description of the patch description string Plugin description text hotfix_id string The kb article ID for the update installed_by string The system context...

  • windows_startup_programs_md5

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_startup_programs_md5 SCHEMA core_file_info string Core file info file_size long File size now global_rep int The machine learning global reputation now global_rep_data string All global reputation data...

  • windows_startup_items

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_startup_items SCHEMA cmdline string Process command line name string Name of the registry value entry path string Full path to the value result string The authenticode signature of the startup item ...

  • windows_services_md5

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_services_md5 SCHEMA description string Plugin description text display_name string Service Display name name string Name of the registry value entry path string Full path to the value sha1 string...

  • windows_services_md5

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_services_md5 SCHEMA description string Plugin description text display_name string Service Display name name string Name of the registry value entry path string Full path to the value sha1 string...

  • windows_programs

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_programs SCHEMA identifying_number string Product identification such as a serial number on software, or a die number on a hardware chip install_date string Date that this product was installed on the system install_source...

  • windows_powershell_script_blocks

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_powershell_script_blocks SCHEMA script_block_count int The total number of script blocks for this script script_block_id string The unique GUID of the powershell script to which this block belongs script_name string...

  • windows_event_user_account_locked_out

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_user_account_locked_out SCHEMA description string Plugin description text eventid int The Windows event ID provider_name string The Windows event provider source string The Windows event source...

  • windows_event_user_account_deleted

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_user_account_deleted SCHEMA description string Plugin description text eventid int The Windows event ID privilege_list string The list of user privileges which were used during the operation provider_name...

  • windows_event_user_account_created

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_user_account_created SCHEMA user_workstations string Contains the list of NetBIOS or DNS names of the computers from which the user can logon. account_expires string The date when the account expires allowed_to_delegate_to...
Unfiltered HTML
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?

Cookie Information Banner