Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
For more information on Live Discover, please check out our Product Documentation
For query assistance, please see Getting LD&R Community Support.

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • windows_event_audit_log_cleared

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    windows_event_audit_log_cleared SCHEMA description string Plugin description text eventid int The Windows event ID provider_name string The Windows event provider source string The Windows event source ...

  • vulnerability_weak_algorithms

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_weak_algorithms SCHEMA data string Data content of registry value key string Name of the key mtime long time of the most recent registry write name string Name of the registry value entry ...

  • vulnerability_unrestricted_paths_item_data

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_unrestricted_paths_item_data SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent...

  • vulnerability_unrestricted_paths

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_unrestricted_paths SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_uac_disabled

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_uac_disabled SCHEMA data string Data content of registry value key string Name of the key mtime long time of the most recent registry write name string Name of the registry value entry path...

  • vulnerability_srp_transparent

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_srp_transparent SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write...

  • vulnerability_srp_exclude_local_admin

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_srp_exclude_local_admin SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_srp_default_level

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_srp_default_level SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_spectre_meltdown

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_spectre_meltdown SCHEMA count long Count of patches -- vulnerability_spectre_meltdown INFO SELECT -- Device ID DETAILS meta_hostname, meta_ip_address, -- Query Details query_name, count, -- Decoration...

  • vulnerability_sehop_validation

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_sehop_validation SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write...
Unfiltered HTML
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?

Cookie Information Banner