Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
For more information on Live Discover, please check out our Product Documentation
For query assistance, please see Getting LD&R Community Support.

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • windows_event_user_account_changed

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_user_account_changed SCHEMA account_expires string The date when the account expires allowed_to_delegate_to string The list of SPNs to which this account can present delegated credentials. description string...

  • windows_event_uac_bypass_journal

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_uac_bypass_journal SCHEMA description string Plugin description text event_time long The time (unix epoch) the value was set event_type int The event type key_name string The registry key path...

  • windows_event_successful_logon

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_successful_logon SCHEMA authentication_package string The name of the authentication package which was used for the logon description string Plugin description text event_timestamps string List of times...

  • windows_event_scheduled_task_created

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_scheduled_task_created SCHEMA description string Plugin description text eventid int The Windows event ID provider_name string The Windows event provider source string The Windows event source...

  • windows_event_replay_attack

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_replay_attack SCHEMA authentication_package string The name of the authentication package which was used for the logon description string Plugin description text eventid int The Windows event ID logon_process...

  • windows_event_invalid_logon_brute_force

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_invalid_logon_brute_force SCHEMA authentication_package string The name of the authentication package which was used for the logon description string Plugin description text eventid int The Windows event...

  • windows_event_invalid_logon

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_invalid_logon SCHEMA authentication_package string The name of the authentication package which was used for the logon description string Plugin description text eventid int The Windows event ID failure_reason...

  • windows_event_dos_attack_detected

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_dos_attack_detected SCHEMA description string Plugin description text eventid int The Windows event ID provider_name string The Windows event provider source string The Windows event source ...

  • windows_event_disallowed_credentials

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_disallowed_credentials SCHEMA cred_type string Types of credentials which were presented for delegation description string Plugin description text eventid int The Windows event ID package string...

  • windows_event_audit_policy_changed

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_audit_policy_changed SCHEMA audit_policy_changes string Changes that were made. category string The name of auditing Category which subcategory was changed. description string Plugin description text ...
Unfiltered HTML
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?

Cookie Information Banner