Sophos Next-Gen SIEM: When is XDR or MDR not enough?

Suspicious access is discovered only months later. IT now needs to establish which accounts were involved, which systems were accessed and whether the events are connected. A clear dashboard is of little help if the relevant data has already been deleted or never arrived.

Sophos Next-Gen SIEM extends XDR and MDR with additional data ingestion, analysis and longer retention. This can close a real gap. It can also become another licence for data whose value nobody defined beforehand.

What is a SIEM, and what does this add?

SIEM stands for Security Information and Event Management. A SIEM collects event records, or logs, from different IT systems in one central location. These include, for example, sign-ins to Microsoft Entra ID, connections on the firewall, alerts from Endpoint protection and changes to servers or applications. A log records what happened, when and on which system, and which account or device was involved.

Collecting data and making it understandable

Each product logs events differently. A firewall describes a connection using a source address, destination and action; an identity service records, for example, the user, sign-in time and outcome. The SIEM ingests the supplied data and maps relevant fields to a common schema. This normalisation makes events from different sources searchable together. It only works if the required information is present in the original log.

Identifying connections and investigating them

The real value emerges when individual events can be linked. For example, several failed sign-ins are followed by a successful sign-in to the same account. Shortly afterwards, that account receives additional privileges and accesses a server. Each event on its own may have an explanation; the sequence deserves investigation.

Detection rules and correlations can highlight such combinations and trigger alerts. Analysts then assess whether they indicate an attack, improper behaviour or legitimate activity. To do so, they search the data, filter by accounts or devices and reconstruct the timeline. False positives need to be assessed and rules adapted to the environment. A SIEM does not automatically understand every business process.

Retaining, analysing and responding

Stored logs also help when a suspicion arises later. Reports can show, for example, sign-in patterns, permission changes or gaps in connected sources. How far an investigation can look back depends on the data actually collected and its retention.

An alert alone does not stop an attack. Blocking an account or isolating a device requires a suitable response integration, permissions and a defined process. Automated responses are possible if the deployed solution and connected systems support them and they have been configured. Otherwise, the responsible person must intervene.

Where Sophos Next-Gen SIEM fits in

Sophos integrates these functions into Sophos Fusion, formerly Sophos Central. The sources, analyses and responses available depend on the purchased products and configured integrations.

XDR connects security data for detection and investigation. MDR adds an operated service with analysts and agreed response capabilities. Next-Gen SIEM extends the data available and its usefulness over longer periods. Having XDR does not provide a round-the-clock analyst service; having MDR does not mean that a SIEM licence automatically adds every conceivable analysis as a new service deliverable.

The technical explanation in our KB helps with planning. Before buying, there should be a specific question that the existing XDR/MDR scope cannot reliably answer.

When is additional data storage useful?

One example is identity incidents that occurred a long time ago. The investigation might require sign-in records, permission changes and relevant firewall events. All three sources must be connected, supply the necessary fields and be retained for the relevant period. An extra year of Endpoint telemetry does not replace missing sign-in events.

Another use case is providing evidence to internal auditors or customers. Ready-made analyses can help present events and coverage clearly. A compliance dashboard does not issue certification or automatically fulfil any regulation. The organisation must determine which data it needs and for how long, then check this against its requirements.

I would therefore start with two or three real investigation questions. For example: can a former service provider’s earlier access be traced? Can changes to privileged accounts be shown over the required period? Sources, fields, retention and costs follow from these questions.

What does “up to ten years” mean?

The technical admin help dated 1 October 2026 specifies 13 months of standard retention and extensions to three, five, seven or ten years. The current Sophos product page, by contrast, specifies one year. As reviewed on 28 October, this difference has not been clearly explained. For the technical explanation, we use the 13 months in the product-specific admin help as a reference; the binding period for the specific tenant and required data must nevertheless be confirmed in the quotation.

“Up to ten years” does not describe a universally included baseline. Our KB guide to retention planning distinguishes the manufacturer’s statements, the retention ordered and the subsequent evidence. Anyone who needs more than twelve months of history should explicitly clarify the additional period before purchasing.

Another equally important point: connecting a source today does not automatically backfill missing historical events. For the investigation period, what matters is when data collection actually began. A migration must therefore establish what happens to existing logs and how long they remain accessible.

Retention is also not the same as recovery. A SIEM does not replace a backup of business data. Even after a well-documented incident, working backups are needed to restore affected applications to operation.

How do the right events get in?

Sophos provides product integrations and options for custom data sources. A source appearing in the catalogue does not, however, mean that the desired event category reaches the tenant. Licensing, API access, the connector and the fields actually supplied must align. Our guide to MDR/XDR integrations describes the operational checks.

For a custom application, for example, it must be clear which format it sends, how users and timestamps are mapped and whether the decisive actions are logged at all. A technically readable record without an unambiguous identity may still be useless for an investigation. A parser helps with mapping, but cannot create events that the source system never supplied.

The Syslog connection for a Sophos Firewall is one example of a transport path. Successful delivery initially proves only transport. For acceptance, a known test event with the correct time, system and action must appear in the analysis and remain retrievable throughout the intended period.

What does Next-Gen SIEM actually cost?

The add-on is intended for XDR or MDR customers and is licensed per user and server. According to the Sophos licensing policy, the quantity must match the total number of corresponding XDR/MDR subscriptions. Counting only administrators or a small pilot group would therefore not be a complete calculation.

Sophos advertises the model without volume-based ingestion charges. This means that pricing is not calculated per ingested gigabyte as in a traditional model. It does not mean unlimited data ingestion: the licensing policy specifies a limit of 1 GB of raw data ingestion per day across all data sources; how this limit applies to the purchased quantity must be clearly established in the quotation.

The total price also includes any desired retention extensions, licences for data sources where necessary, setup and ongoing operation. For a useful comparison, a quotation must cover the same data scope and retention as the alternative.

Who investigates the collected data?

A SIEM requires source monitoring, field mapping maintenance and the ability to run analyses. If an integration fails, the first indication must not come during an incident. Someone needs to know when each source last supplied data and which changes to the source system affect the flow.

MDR already provides analysts for the agreed security service. That does not mean blanket handling of every compliance report or custom data source. Before extending the system, it must be clear which additional data Sophos investigates within the purchased service and which analyses remain with the organisation’s own IT team. A shared data store does not remove these responsibility boundaries.

When would I buy the add-on?

Next-Gen SIEM can make sense when the required investigation or retention is not possible within the existing scope. A pilot should have a representative source, a specific question and a named owner. The result should be a traceable analysis whose data completeness and effort are known.

Anyone who already fails to act on current alerts gains little from longer storage alone. Responsibilities and existing controls need to work first. I would buy the add-on to close a named gap, rather than simply because “more logs” sounds like more security.

Frequently asked questions