Sophos Community
Sophos Community
  • User
  • Site
  • Search
  • User
  • Community & Product Forums
  • Blogs
  • Partners
  • Events & Webinars
  • Getting Started
  • Support Portal
  • Community Blogs
    • Application Control
    • Community
    • Product documentation
    • Security
  • Feedback
    • Support Portal
    • Product documentation
  • Products
    • Endpoint security
      • Sophos Endpoint
      • Sophos XDR
      • Device Encryption
      • Sophos Mobile
    • Network Security
      • Sophos Firewall
      • Sophos ZTNA
      • Sophos Switch
      • UTM Firewall
      • Sophos Wireless
      • Sophos NDR
    • Email Security
      • Sophos Email
      • Phish Threat
    • Cloud Security
      • Sophos Central
      • Sophos Cloud Optix
    • Support Tools
      • Sophos integrations
      • Free tools
    • AI Solutions
      • Sophos AI
  • Services
    • Management platform
      • Sophos Professional Services
      • Sophos Central
      • Support Portal
      • Sophos Community log in
  • Sophos Partners
    • Partners blog
    • Local Partner community
    • Partner news
  • Resources
    • MSP guides
    • Partner Care
    • Sophos Central
  • Webinars & Events
    • Webinars & Events
    • Calendar
  • Become a partner
    • Join our program
  • Events & Webinars
    • Events & Webinars
    • Calendar
    • Recordings
  • Getting started in the Community
    • How to get started
    • SophosID registration
    • How to set up your profile
    • How to contribute and participate
    • How to manage private messages
  • Member recognition
    • Recognition program
    • Leaderboard
  • Products and Services
    • Products
      • Endpoint security
        • Sophos Endpoint
        • Sophos XDR
        • Device Encryption
        • Sophos Mobile
      • Network Security
        • Sophos Firewall
        • ZTNA
        • Sophos Switch
        • UTM Firewall
        • Sophos Wireless
        • NDR
      • Email Security
        • Sophos Email
        • Phish Threat
      • Cloud Security
        • Sophos Central
        • Sophos Cloud Optix
      • Support Tools
        • Sophos integrations
        • Free tools
      • AI Solutions
        • Sophos AI
    • Services
      • Management platform
        • Sophos Professional Services
        • Sophos Central
        • Support Portal
        • Sophos Community log in
  • Blogs
    • Community Blogs
      • Application Control
      • Community
      • Product documentation
      • Security
    • Feedback
      • Support Portal
      • Product documentation
  • Partners
    • Sophos Partners
      • Partners blog
      • Local Partner community
      • Partner news
    • Resources
      • MSP guides
      • Partner Care
      • Sophos Central
    • Webinars & Events
      • Webinars & Events
      • Calendar
    • Become a partner
      • Join our program
  • Events & Webinars
    • Events & Webinars
      • Events & Webinars
      • Calendar
      • Recordings
  • Getting Started
    • Getting started in the Community
      • How to get started
      • SophosID registration
      • How to set up your profile
      • How to contribute and participate
      • How to manage private messages
    • Member recognition
      • Recognition program
      • Leaderboard
  • Support Portal
Sophos Endpoint
Sophos Endpoint
Live Discover & Response Query Forum Live Discover & Response Query Forum
  • Release Notes & News
  • Discussions
  • Recommended Reads
  • Threat Hunting Academy
  • Early Access Programs
  • Live Discover & Response Query Forum
  • Calendars
  • More
  • Cancel
  • New
Sophos Endpoint requires membership for participation - click to join
Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
For more information on Live Discover, please check out our Product Documentation
For query assistance, please see Getting LD&R Community Support.

Sophos Community XDR Queries on GitHub


Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
  • Uncategorized

  • Anomalies

  • ATT&CK

  • Cloud Optix

  • Compliance

  • Data Lake

  • Device

  • Email

  • Events

  • Files

  • Live Response

  • Network

  • Other queries

  • Processes

  • Query Tips

  • Registry

  • Threat Hunting

  • User

Latest Live Discover and Response Queries (All)
  • windows_updates_patch

    Karl_Ackerman
    Karl_Ackerman
    • Queries
    • Under Review on 14 Oct 2020
    • 0 Comments
    windows_updates_patch SCHEMA caption string Short description of the patch description string Plugin description text hotfix_id string The kb article ID for the update installed_by string The system context...
    • 14 Oct 2020 8:36 PM
  • windows_startup_programs_md5

    Karl_Ackerman
    Karl_Ackerman
    • Queries
    • Under Review on 14 Oct 2020
    • 0 Comments
    windows_startup_programs_md5 SCHEMA core_file_info string Core file info file_size long File size now global_rep int The machine learning global reputation now global_rep_data string All global reputation data...
    • 14 Oct 2020 8:34 PM
  • windows_startup_items

    Karl_Ackerman
    Karl_Ackerman
    • Queries
    • Under Review on 14 Oct 2020
    • 0 Comments
    windows_startup_items SCHEMA cmdline string Process command line name string Name of the registry value entry path string Full path to the value result string The authenticode signature of the startup item ...
    • 14 Oct 2020 8:31 PM
  • windows_services_md5

    Karl_Ackerman
    Karl_Ackerman
    • Queries
    • Under Review on 14 Oct 2020
    • 0 Comments
    windows_services_md5 SCHEMA description string Plugin description text display_name string Service Display name name string Name of the registry value entry path string Full path to the value sha1 string...
    • 14 Oct 2020 8:29 PM
  • windows_services_md5

    Karl_Ackerman
    Karl_Ackerman
    • Queries
    • Under Review on 14 Oct 2020
    • 0 Comments
    windows_services_md5 SCHEMA description string Plugin description text display_name string Service Display name name string Name of the registry value entry path string Full path to the value sha1 string...
    • 14 Oct 2020 8:29 PM
  • windows_programs

    Karl_Ackerman
    Karl_Ackerman
    • Queries
    • Under Review on 14 Oct 2020
    • 0 Comments
    windows_programs SCHEMA identifying_number string Product identification such as a serial number on software, or a die number on a hardware chip install_date string Date that this product was installed on the system install_source...
    • 14 Oct 2020 8:26 PM
  • windows_powershell_script_blocks

    Karl_Ackerman
    Karl_Ackerman
    • Queries
    • Under Review on 14 Oct 2020
    • 0 Comments
    windows_powershell_script_blocks SCHEMA script_block_count int The total number of script blocks for this script script_block_id string The unique GUID of the powershell script to which this block belongs script_name string...
    • 14 Oct 2020 8:24 PM
  • windows_event_user_account_locked_out

    Karl_Ackerman
    Karl_Ackerman
    • Queries
    • Under Review on 14 Oct 2020
    • 0 Comments
    windows_event_user_account_locked_out SCHEMA description string Plugin description text eventid int The Windows event ID provider_name string The Windows event provider source string The Windows event source...
    • 14 Oct 2020 8:21 PM
  • windows_event_user_account_deleted

    Karl_Ackerman
    Karl_Ackerman
    • Queries
    • Under Review on 14 Oct 2020
    • 0 Comments
    windows_event_user_account_deleted SCHEMA description string Plugin description text eventid int The Windows event ID privilege_list string The list of user privileges which were used during the operation provider_name...
    • 14 Oct 2020 8:19 PM
  • windows_event_user_account_created

    Karl_Ackerman
    Karl_Ackerman
    • Queries
    • Under Review on 14 Oct 2020
    • 0 Comments
    windows_event_user_account_created SCHEMA user_workstations string Contains the list of NetBIOS or DNS names of the computers from which the user can logon. account_expires string The date when the account expires allowed_to_delegate_to...
    • 14 Oct 2020 8:17 PM
<>
Unfiltered HTML
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?

Cookie Information Banner

Defeat Cyberattacks

Footer - Default

  • Column 1
    • Endpoint Security
      • Sophos Endpoint
      • Sophos XDR
      • Device Encryption
      • Sophos Mobile
    • Email Security
      • Sophos Email
      • Phish Threat
    • Support Tools
      • Sophos integrations
      • Free tools
  • Column 2
    • Network Security
      • Sophos Firewall
      • Sophos ZTNA
      • Sophos Switch
      • UTM Firewall
      • Sophos Wireless
      • Sophos NDR
    • Cloud Security
      • Sophos Central
      • Sophos Cloud Optix
  • Column 3
    • Partners
      • Find a partner
      • Managed service providers
      • Join our program
    • Current Partners
      • Partners blog
      • Local Partner Community blog
      • Partner MSG guides
      • Partner news
      • Partner care
      • Partner portal login
      • Training & certification
    • Management Platform
      • Sophos Central
  • Column 4
    • Support
      • Downloads and updates
      • Support packages
      • Support portal
      • Sophos Customer Success
      • Sophos Techvids
      • Sophos Learning Center
      • Sophos status
      • Tech support
    • Learn
      • Threat intelligence
      • X-Ops threat research
      • Trust center
      • Security blogs
      • Sophos Academy
  • Column 5
    • Getting Started
      • How to get started
      • Community FAQs
    • Member Recognition
      • Recognition program
      • Leaderboard
    • Events & Webinars
      • Webinars
      • Calendar
      • Recordings
  • Column 6
    • Try for Free
      • Free trials
      • Product demos
    • Sophos Home Premium
      • Sophos Home support
      • Contact Home support
      • Mac antivirus download
      • PC antivirus download
    • About Us
      • Company
      • Events
      • Press
      • Careers
  • Getting Started
  • Terms
  • Privacy
    • Privacy Notice
    • Cookies
  • Legal
    • General
    • Modern Slavery Statement
    • Speak Out
© 1997- Sophos Ltd. All Rights Reserved.