Isolate Sophos Endpoint and use Live Response
During an active suspicion, isolation is often the fastest way to stop further communication. Sophos Central keeps its management channel available, so an isolated device can still receive policies and be investigated with Live Response.
The Network Threat Protection driver implements the isolation technically. Administrator isolation requires EDR, XDR or MDR. This article covers Windows and macOS endpoints. Sophos Protection for Linux belongs to the separate server and workload area and does not automatically use the same isolation exclusions.
Consider business impact, evidence preservation and contact availability before isolation. For ransomware, credential theft or command-and-control traffic, containment normally takes priority.
Two types of isolation
| Type | Trigger | Release |
|---|---|---|
| Admin isolate | administrator isolates manually | administrator can remove isolation |
| Automatic device isolation | Threat Protection policy isolates when local health is red | automatic only after remediation and green local health |
Global Settings > Protection and Remediation > Allow and Block > Network > Admin Isolated Devices lists only devices isolated by an administrator, not automatically isolated devices.
Pilot automatic isolation
The option is part of the Threat Protection policy. A device isolates itself when its local health turns red, for example because of a threat, outdated software, policy non-compliance or incomplete protection.
Sophos recommends testing with a representative group. An automatic-isolation model needs a support path for devices that turn red because of network or software faults.
Automatic isolation cannot simply be removed manually. Correct the cause. Once the endpoint reports green local health, isolation ends.
A red health state can arise during shutdown when a third-party service delays shutdown while Sophos Health sees a protection service that has already stopped. If the device is automatically isolated after startup, examine the System Event Log and Service Control Manager around the shutdown. A known trigger is a timeout of HPAudioAnalytics with Event ID 7011. Resolve the causing third-party service with its vendor instead of permanently disabling automatic isolation.
Admin isolation
Open the device under My Environment > Computers & Servers and isolate it through Actions. It can later be released through the device record or Admin Isolated Devices.
Reconnect only after:
- active processes and persistence have been checked
- threats have been cleaned or blocked
- credentials have been rotated where required
- the agent and operating system are current
- health is plausible
- monitoring for possible recurrence is in place
Prepare Live Response
Live Response requires Sophos EDR, XDR or MDR. Enable it for computers in the Data Collection and Investigation policy under My Products > Endpoint > Policies.
Permissions are assigned separately:
- manage the policy setting
- start a Live Response session
Super Admins have the required rights. Other operators need a narrowly scoped Custom Role. MFA is required when starting a session.
For federated sign-in with a supported identity provider, IdP Enforced MFA can replace the additional Central MFA prompt at session start. Enable this only when the identity provider reliably enforces and logs the MFA challenge.
Live Response is enabled by default with MDR and normally disabled by default with other eligible licences. Sensitive devices can receive a separate policy with Live Response disabled.
Start a session
- Open My Environment > Computers & Servers.
- Select the device.
- Choose Actions > Live Response.
- Describe the session purpose precisely.
- Use the terminal in the new browser tab.
- Record investigation and changes continuously.
- Finish with End Session.
The connection also ends when the tab closes or reloads and after 30 minutes without activity.
Live Response is a privileged remote shell. Do not experiment with commands on production systems. Verify paths, hashes, dependencies and evidential value before changing files or processes.
Investigate an isolated device
Separate collection from modification:
- capture time, users, network connections and running processes
- hash suspicious files and verify signatures
- inspect autostarts, scheduled tasks and persistence
- preserve relevant logs and artefacts
- only then stop a process, remove a file or change configuration
- rerun the central scan and review the Threat Graph
Coordinate local changes with an MDR team when involved. Parallel actions can destroy evidence or interfere with each other.
Forensic Snapshots
A Forensic Snapshot captures recent device activity. Sophos automatically creates data for Threat Graphs for certain detections. An on-demand snapshot is available under My Environment > Computers & Servers > device > Summary > More actions > Create forensic snapshot.
Default path for manual Windows snapshots:
%PROGRAMDATA%\\Sophos\\Endpoint Defense\\Data\\Forensic Snapshots\\
Automatically retained detection data:
%PROGRAMDATA%\\Sophos\\Endpoint Defense\\Data\\Saved Data\\
With Tamper Protection enabled, local access requires an elevated command prompt. Conversion and analysis are separate steps. S3 upload is available only for Windows with an XDR or MDR licence.
By default, a snapshot covers the previous two weeks. The period can be adjusted or all available log data selected under Global Settings > Products and Services > Endpoint and Server > Forensic Snapshots.
For analysis, convert the snapshot to SQLite or JSON with SDR Exporter. A snapshot is therefore not a directly readable report. Record the input, output format and hash of the original in the investigation.
For central upload to AWS S3, the Sophos role receives only s3:ListBucket and s3:PutObject for the intended bucket. A lifecycle rule should remove aborted multipart uploads to avoid unnoticed storage costs. KMS encryption is not currently supported for this upload; AES-256 is supported and recommended.
Store the bucket name and optional destination directory together with the Role ARN under Global Settings > Products and Services > Endpoint and Server > Forensic Snapshots. Add the AWS Account ID and External ID displayed by Central to the role’s trust policy. After creating the role, allow up to five minutes for AWS replication before saving the configuration and testing it with a pilot device.
Special characters in the bucket name are not supported. A snapshot upload expires if it takes longer than one hour, so test large time ranges and slow links before production use. Firewall rules must allow the S3 upload. In the MCS log, a received presigned URL, the subsequent PUT and the message Upload ... succeeded prove a successful transfer. Also reconcile the Central success message and device event with the object actually present in the bucket.
Event Journals must already have been enabled for the relevant history to exist. A later snapshot cannot reconstruct activity that was never recorded.
Audit and follow-up
General Live Response start and end activity appears in the Sophos Central Audit Log. Under Reports > Logs > Live Response session audit, a compressed session log containing the commands entered can also be downloaded. The role requires both the computer and server permissions for managing Live Response.
Sensitive environments also record the ticket ID, purpose, operator, commands, retained artefacts and result.
After cleanup, update and scan the device, verify effective policies and observe it for a defined period. Only then remove an administrative isolation.