Sophos EDR and XDR Use Cases
Available with Intercept X Advanced with XDR, Intercept X Advancedwith EDR, Intercept X Advanced for Server with XDR and Intercept X
Advanced for Server with EDR
Answer business critical IT operations and threat hunting questions then take action where needed.
Both IT admins and cybersecurity analysts can take advantage of the powerful functionality.
Perform IT security operations and threat hunting tasks
Ì Choose from fully customizable, pre-written SQL queries
Ì Quickly take action when you have the information you needÌ Covers endpoints, servers, firewalls, email, cloud hosts and more

IT Operations Use Cases
IT Operations Use Cases Keep your IT operations hygiene in peak condition. Here are a few example use cases:
Device health checks

Configuration oversights

Identify devices that are having performance issues thenremotely access them and take needed action.

Find devices and cloud workloads that have configuration
issues that can pose security risks.

Ì Find devices with low disk space, high memory/CPU usage or that are pending reboot

ÌÌ Remotely access devices to free up disk space, investigate
causes of high usage and reboot as needed

Identify servers with RDP and SSH enabled, cloud security groups with network
ports left open, monitor and inventory public cloud hosts, containers and moreÌ

Remotely access the servers, disable RDP/SSH andcheck for servers listening on the open ports

Vulnerabilities
Detect devices that have issues or vulnerabilities thatcan be exploited by malware or attackers.
ÌLocate devices with software vulnerabilities, unknown services running or
unauthorized browser extensions and detect shared or stolen account credentials

ÌRemotely access devices to install patches, investigate and terminate unknown
services, uninstall browser extensions and update cloud account credentials

Unwanted software
Track down software that could cause compliance or productivity issues.
ÌFind unwanted programs such as Spotify, Steam and BittorrentÌRemotely access devices and uninstall the software

Compliance
Identify and address compliance issues on-premises and in the cloud.
Ì

Find sensitive files, assess configurations for AWS, Azure and GCP environmentsÌRemotely access devices to delete sensitive files, ensure
secure cloud configurations against CIS benchmarks

Project rollouts
Check whether IT projects have been rolled out across all devices.
ÌSee if software has been deployed on devices to measure progress throughout rolloutÌRemotely access devices to ensure successful deployment andreboot if required to make any necessary changed

Office network issues (requires XDR)Expect the unexpected (requires XDR)

See and rectify network issues across your office sites.

With 30 days of cloud storage don’t get caught out by unexpected events.

ÌUnderstand why an office is having network issues that are slowing performanceÌ

Look back 30 days for unusual activity on a missing deviceÌ

Identify which application is causing the problem

ÌSee what happened to a device even if it has been wiped or destroyed

Device management (requires XDR)
Identify and understand the devices in your organization’s IT environment.

ÌSee unmanaged and unprotected devices such as laptops, mobiles and IoT devicesÌ

Get additional oversight on legacy or unmanageable devices
such as specialized medical equipment

Threat Hunting Use Cases
Track down evasive, subtle threats and quickly clean them up. Here are just a few example use cases:Network attacks

Disguised processes

Identify process making unusual network access attempts.

Some malicious processes disguise themselves to avoid detection.

Ì

Detect processes attempting to connect on non-standard ports
or unusual outbound traffic from a cloud workloadÌ

Detect processes that have disguised themselvesÌAnalyze cloud security groups to identify resources exposed to the public internetÌ

Remotely access the device, terminate suspicious
processes and run forensic toolsÌRemotely access the device/workload, terminate theprocess and check for lateral movement

MITRE ATT&CK framework

Modified files

The MITRE ATT&CK framework is a commonly used
template for identifying attack techniques.

Find items that haven been modified in an unexpected manner.

ÌUse your own or Sophos queries to identify attack
tactics and techniques used by adversaries

Ì

Based on the identified technique hone your investigation to lookat potential follow up attacks or areas to double checkÌIdentify processes that have recently modified files or registry keys

Ì

Remotely access the device, examine the changes and take action

Obfuscated scripts

Incident scope

File-less, memory-based attacks are a common attack vector.

Understand the impact of an incident and which
devices and users were impacted.

ÌDig into the details of unexpected PowerShell executions

ÌRemotely access the device, run additional forensic
tools and terminate suspect processes

Ì

Identify devices that clicked on a link from a phishing emailÌ

See which devices downloaded files from the phishingsite, remotely access them and perform cleanup

Extend investigation periods (requires XDR)
Use 30 days of cloud data in addition to 90 days on device data storage.

ÌInvestigate 30 days of data without needing to bring a device back online

ÌSee what happened to devices incapacitated in an attack

Use rich network data (requires XDR)
Incorporate network data into your threat hunting and investigation.

ÌCross reference blocked malicious traffic with other IoCs to understand a wider attack

Ì

Use ATP and IPS detections from the firewall to investigate suspect hosts and devices

Use rich email data (requires XDR)
Integrate email information to get additional insight into your environment.

ÌCompare email header information with other IoCs to better understand an incidentÌIdentify suspicious files and quickly delete them from devices and O365 mailboxes

To learn more about Sophos XDR, EDR and the powerful protection capabilities inIntercept X head over to Sophos.com.

© Copyright 2021. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UKSophos is the registered trademark of Sophos Ltd. All other product and company names mentioned are trademarks
or registered trademarks of their respective owners.

21-03-26 UC-NA (MP)