Changes to Sophos EDR Threat Indicators and Threat Search features
| Starting July 1, 2021, the Threat Indicators and Central Threat Search features in Sophos EDR and XDR products will be retired. The functionality will be replaced by new pre-built Live Discover queries which will provide similar functionality. |
| With the new scheduling capabilities included in the latest version of the EDR product, customers can now schedule these canned queries in Central, which will automatically refresh the results. |
| Please visit the Sophos Community for more details, including how queries can be scheduled to help automate your EDR investigations. |
| In addition to the revamped Threat Indicators and Central Threat Search features, a key new EDR component is the Sophos Data Lake which stores critical data from EDR enabled devices and allows Live Discover to search across devices, even when they are offline. |
| Please note that to query data in the Data Lake customers need to first enable this feature. To do so in the Sophos Central console select ‘Global Settings’. Under Endpoint or Server Protection (or both) select the ‘Data Lake uploads’ setting and turn on the ‘Upload to the Data Lake’ toggle. From the settings page you can also exclude specific devices from sending data to the Sophos Data Lake. |
| Should you have any questions, please do not hesitate to reach out to your local Sophos team. |
