Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
For more information on Live Discover, please check out our Product Documentation
For query assistance, please see Getting LD&R Community Support.

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • Query for System Reboots/Shutdowns

    JeramyKopacko
    • Events
    • Approved on
    • 1 Comment
    Posted this for easier access as I am sharing it with another community user who looked for this functionality: SELECT DISTINCT eventid, CASE eventid WHEN '41' THEN 'Rebooted without clean shutdown' WHEN '1074' THEN 'Shutdown properly by user...

  • Live Discovery Query for Event log - system reboots

    Chad Tracy
    • Events
    • Complete on
    • 1 Comment
    Hello. I am not sure I even have this messages going to the right group. I am trying to find a query I can use that will show me a timestamp for when a machine reboots. Any help you can provide would be greatly appreciated. Best Chad

  • Compare IP activity to Remote List of IOC IP addresses

    Spencer_Brown
    • Threat Hunting
    • Under Review on
    • 0 Comments
    Utilizing a post from Karl_Ackerman and the precanned queries in Sophos Central, here is a query that can pull down a remote csv table, and join it to the sophos_ip_journal. It takes one variable: URL -- String -- $$URL$$ In this use case, I took...

  • List all NIX processes during a boot session

    Karl_Ackerman
    • Threat Hunting
    • Approved on
    • 0 Comments
    Given a time we want to list all processes that ran during the boot session. -- This will take a few steps. First lets narrow down the time range ---------------------- -- DETERMINE THE LOWER AND UPPER TIME LIMITS FOR THE SOPHOS_PID -------...

  • NIX TTP Detector (MITRE ATT&CK)

    Karl_Ackerman
    • Threat Hunting
    • Approved on
    • 0 Comments
    Below is a query to classify activity to MITRE for NIX machines (LINUX and MAC). It runs against the data lake The detection risk level has not been tuned, so you will need to edit the query in your environment. /*******************************...

  • Rare process trees with a LOLBIN tool

    Karl_Ackerman
    • Threat Hunting
    • Approved on
    • 0 Comments
    With leadless threat hunting where you are simply looking for strange activity in the environment to determine if it is an as yet undiscovered adversary it is often valuable identify things that are RARE or UNIQUE. With the Rare Tree query below we...

  • List Installed Deb Packages on Debian/Ubuntu Linux Serve

    benjm
    • Device
    • Approved on
    • 0 Comments
    SELECT name "Package name", version "Package version", source "Package source", size "Package size in bytes", arch "Package architecture", revision "Package revision" FROM deb_packages

  • Last reboot time (Uptime)

    MichaelCurtis
    • Data Lake
    • Approved on
    • 0 Comments
    SELECT meta_hostname, MAX(meta_boot_time) AS EPOC, DATE_FORMAT(FROM_UNIXTIME(MAX(meta_boot_time)), '%Y-%m-%dT%H:%i:%SZ') AS Last_Reboot_Time FROM XDR_DATA GROUP BY meta_hostname ORDER BY Last_Reboot_Time ASC This query will report the last reboot date...

  • Software install count by version

    MichaelCurtis
    • Data Lake
    • Approved on
    • 1 Comment
    -- Software list temp table WITH software_temp AS ( SELECT DISTINCT name, MAX(version) AS version, meta_hostname FROM xdr_data WHERE query_name = 'windows_programs' Group BY name, meta_hostname ) select name AS Software_Title, version ,COUNT(version)...

  • Find out of date software

    MichaelCurtis
    • Data Lake
    • Approved on
    • 0 Comments
    -- Variables -- $$Software_Name$$ - String - Name of out of date software you are looking for -- $$Software_Version$$ - Latest version number. The query will return the software NOT running this version -- Software list temp table WITH software_temp AS...
Unfiltered HTML
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?