Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
For more information on Live Discover, please check out our Product Documentation
For query assistance, please see Getting LD&R Community Support.

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • vulnerability_sehop

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_sehop SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write ...

  • vulnerability_secureboot

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_secureboot SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write ...

  • vulnerability_safer_flags_not_enforcing

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_safer_flags_not_enforcing SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_safer_flags_missing

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_safer_flags_missing SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_outlook_flags

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_outlook_flags SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write...

  • vulnerability_opentype_font

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_opentype_font SCHEMA data string Data content of registry value key string Name of the key mtime long time of the most recent registry write name string Name of the registry value entry path...

  • vulnerability_kernel_null_page_access

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_kernel_null_page_access SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_fontblocking

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    vulnerability_fontblocking Schema analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry write...

  • vulnerability_disallowed_paths_item_data

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    Additional info for disallowed paths SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long time of the most recent registry...

  • vulnerability_disallowed_paths

    Karl_Ackerman
    • Queries
    • Under Review on
    • 0 Comments
    Detect disallowed paths, need to get a definition of such from MRT SCHEMA analysis string JSON object representing the analysis data string Data content of registry value key string Name of the key mtime long...
Unfiltered HTML
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?

Cookie Information Banner