Solution Brief

Sophos Integrations: Identity
Detect and respond to suspicious user activity

Sophos’ 2024 State of Ransomware report highlights that compromised credentials are the root causeof ransomware attacks in 29% of incidents. Implementing multi-factor authentication is critical for
mitigating unauthorized access. Sophos XDR and MDR integrations with identity providers enable security
analysts to discover malicious activity and active adversaries masquerading as legitimate users.

Use Cases
1 | IDENTIFY ACCOUNT COMPROMISE

Integrations include

Desired Outcome: Uncover authentication-related issues, including brute force attacks,
credential stuffing, and attempts to bypass multi-factor controls.
Solution: Early detection of adversaries attempting to exploit compromised credentials
is crucial to prevent the exposure of sensitive data and systems. Insider threats andunauthorized use by employees or contractors pose significant risks. Sophos XDR andMDR integrations with identity providers enable analysis of security events, ensuring fast
remediation of post-exploit activities.

and more.

2 | DETECT ABNORMAL GEOLOCATION LOGINS
Desired Outcome: Discover unusual logins to identify illicit access.
Solution: Geolocation tracking enables systems to detect logins from atypical locations.
Sophos’ Identity integrations capture telemetry to identify untrusted or unenrolled
endpoints, invalid or disabled assets, and blacklisted zones. Detect unauthorized accessby correlating historical data with real-time activity across protected assets within thenetwork.

Named a Leader in XDR in the G2
Summer 2024 Reports

3 | STOP AND RESPOND TO CREDENTIAL ABUSE
Desired Outcome: Prevent ongoing access by credentials harvested to establish
persistence.
Solution: Attackers move laterally using stolen login credentials, targeting devices thatevade detection. Leveraging data from your identity platform, security analysts identify
compromised accounts, confirm breaches, and execute response actions to disrupt
attacker access, including host-based account lockouts, suspending users, resetting user
passwords, and more.

A Customers’ Choice in the 2023
Gartner®, Voice of the Customer
for Managed Detection andResponse Services report

4 | SUPPORT COMPLIANCE REQUIREMENTS
Desired Outcome: Monitor and report irregular logins as mandated by regulatorystandards.
Solution: Collecting alerts from identity solutions enables you to meet requirementsof regulatory standards, including GDPR and HIPAA, shielding your organization frompotential legal and financial consequences. As an optional add-on, Sophos allows
ingested log data to be retained for up to 365 days for all Sophos XDR and MDR
integrations.

To learn more, visit
www.sophos.com/mdr
www.sophos.com/xdr

Gartner, Voice of the Customer for Managed Detection and Response Services, 28 July 2023. The Gartner Peer Insights Logo is a trademark and service mark of Gartner,Inc., and/or its affiliates, and is used herein with permission. All rights reserved. Gartner Peer Insights content consists of the opinions of individual end users based on theirown experiences with the vendors listed on the platform, should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner
does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy orcompleteness, including any warranties of merchantability or fitness for a particular purpose.
© Copyright 2024. Sophos Ltd. All rights reserved. Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UKSophos is the registered trademark of Sophos Ltd. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

2024-07-23 SB-EN (PS)