Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
For more information on Live Discover, please check out our Product Documentation
For query assistance, please see Getting LD&R Community Support.

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • Find Domain Controllers

    j0hnV
    • Device
    • Approved on
    • 0 Comments
    REVIEWED by Sophos SELECT os_version.name os_name, services.name, services.display_name, services.start_type, services.path, services.status, services.user_account FROM services JOIN os_version WHERE services.name = 'NTDS' To only find machines...

  • Live Discover Query - That nasty Microsoft DNS bug - SigRED a.k.a CVE-2020-1350

    AzRoN
    • Threat Hunting
    • Approved on
    • 1 Comment
    REVIEWED by Sophos As the title says, Microsoft recently advised a of a nasty bug within MS DNS servers. NakedSecurity has a great write up with suggested actions, PATCH NOW. Or implement a work around. https://nakedsecurity.sophos.com/2020/07/15...

  • Live Response read text files; change configuration files etc.

    Giu
    • Live Response
    • Under Review on
    • 2 Comments
    Hello 99% of my time I use the GUI; so when it comes to use the CMD prompt I feel a little uncomfortable I am trying to use live response; in the kb and other documentation it is stated that with Live Response on windows you can: Reboot a device that...

  • List software installed between two dates

    MichaelCurtis
    • Device
    • Approved on
    • 1 Comment
    REVIEWED by Sophos This query will list all the software installed between two dates, taking Sophos out of the list. The variable screen is below. It also shows the format. Some software has no date so that is returned just in case it helps SELECT...

  • Check for conflicting windows security software

    j0hnV
    • Device
    • Approved on
    • 1 Comment
    REVIEWED by Sophos Customers confronted with unexplainable red statusses and installation/update issues were helped by this: ------- select * FROM windows_security_products WHERE name is not 'Windows Firewall' and name is not 'Microsoft Defender...

  • Check version of Firefox installed vs latest available

    AndrewMundell
    • Device
    • Approved on
    • 0 Comments
    REVIEWED by Sophos A quick and dirty query leveraging curl to get the latest version of Firefox from Mozilla.org and compare to the installed version. Uses curl a bit too much, but I'm having trouble using "with" clauses and parsing that result, hopefully...

  • BitLocker Status

    MichaelCurtis
    • Device
    • Approved on
    • 0 Comments
    REVIEWED by Sophos A query that will return the BitLocker status of an Endpoint SELECT device_id,drive_letter,percentage_encrypted, encryption_method, version, persistent_volume_id, CASE conversion_status WHEN 1 THEN 'Fully Encrypted' WHEN 2 THEN...

  • Identify all portable executables deployed or modified by a process name over time

    Karl_Ackerman
    • Anomalies
    • Approved on
    • 0 Comments
    REVIEWED by Sophos For this query we want to identify all portable executables that have been written to the device. We have some variables so if you want to can look for the Portable Executables created by a specific process %powershell% or all processes...

  • 10 queries for exploring windows events and security groups

    Karl_Ackerman
    • User
    • Approved on
    • 0 Comments
    REVIEWED by Sophos The Sophos UK Sales engineering team has been getting familiar with live discover. In the work they explored group policy and provided the following queries: Deleted security groups - Variable to specify the number of days to...

  • Simple query to audit Microsoft RDP enablement status (from registry)

    AndrewMundell
    • Device
    • Approved on
    • 0 Comments
    REVIEWED by Sophos Just a quick query to audit the state of MS RDP via the registry, uncomment (remove the 2 leading '--' from the last line) to return only machines where RDP is enabled. SELECT CASE WHEN data = 0 then 'RDP Enabled' WHEN data...
Unfiltered HTML
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?

Cookie Information Banner