What kind of data can be analyzed in Discover Mode

Question

Dear All, 
 We know it's simple to enable TAP/Discover mode in Sophos XG, 
 but anyone knows what kind of data can be analyzed in this mode? 
 Host traffic? Web/Application category? Malware? IPS? Or ATP? 
 Thanks~

lferrara · Accepted Answer

Shunze, 
 AFAIK SAR includes all the information that is passed to XG in terms of network and web traffic. So All the above data should be available. In TAP mode, remember that you cannot block traffic. 
 You can schedule SAR even if the XG is deployed in routing/bridge or mixed mode so I would recommend you to enable it on an XG and then you can see what traffic is reported. 
 Regards

lferrara · Answer

Shunze, 
 I found the Sophos SAR example on Partner Portal. 
 5415.ET802_Sample_SAR.docx 
 Enjoy it!