Live Users - No clients show

If you want AD integration and get users from AD you will need to use STAS.

If you want Sophos Central integration and get users from Sophos Central you will need SFOS 17.5 and Endpoint with EDR (beta) on clients.

Seems you did both which is ok but not necessary. So just look at the way you want it to work.

What is the version of Sophos Endpoint on your clients?

Are the users and computers listed in Sophos Central?

Check the logviewer / authentication. Do you see "failed authentication attempts"?

The only entries seen are when I manually logged in to port 6090 on firewall to check, which show successful login and successful logout

Can you show us a screenshot from client version?

What do you mean from client version?

Do you have Sophos Endpoint installed?

If yes please post the version number you find in the GUI under Information.

If not then user sync doesn't work.

Core Agent = 2.2.1
Endpoint Advanced = 10.8.3
InterceptX = 2.0.10

On XG dashboard it shows 2 clients connected (Security Heartbeat), which is correct.

I'm pretty unsure if it needs the beta (currently 2.2.2 beta) for this to work...

Do we know how to get beta 2.2.2?

I did find this, but does not advise what the version is that will be installed. But does say it applies to Central InteceptX 2.0.08, but its already 2.0.10 and was released today


Sophos Central Intercept X, Central Server Intercept X Advanced and Sophos Exploit Prevention cumulative hotfix
https://community.sophos.com/kb/en-us/133140

Join https://community.sophos.com/products/intercept/early-access-preview/ and join the EAP in Sophos Central.

Follow this PowerPoint: /cfs-file/__key/communityserver-discussions-components-files/46/6811.Joining-EDR-Early-Access-Program-16-09-2018.pptx

A little confused. InterceptX with EDR went 'live' 10 days or so ago. How is this EAP for the EDR version different to the 'live' version?

A little confused. InterceptX with EDR went 'live' 10 days or so ago. How is this EAP for the EDR version different to the 'live' version?

I can't tell you but as far as I know Central integration only works with the current beta version of Endpoint.

OK - I try on one machine a bit later and see what happens and will update thereafter

The endpoint has updated and now says as shown below, which are the same numbers as the GA release except they have the word beta after them

Core = 2.2.1 beta

Endpoint Advanced = 10.8.3 beta

InterceptX = 2.0.10


Still no client showing under Live Users

Should update to

Core Agent 2.2.2 Beta

Sophos Intercept X 2.0.11

But that is not necessary for Central integration.

In Sophos Central your pcs show a local IP address and are assigned to a user, right?

I just noticed at another customer site, was 222 + 2.0.11

Yes, both name and IP address shows

I will try another update to see if I get 2.2.2

Done an update and still at 2.2.1

I guess I will have to wait until Sophos allocates the update to the group of clients that I am in?

As mentioned before 2.2.2 is not necessary as it worked for me with 2.2.1 Beta.

Guess there is something else which is not working.