Use Sophos AI Assistant and AI Search in XDR

Sophos AI Search and the Security Analyst and Threat Hunter assistants are XDR investigation tools in Sophos Fusion (formerly Sophos Central). They are not general endpoint-agent features and don’t perform autonomous remediation. AI Search turns natural-language searches into Data Lake queries; the investigation assistants support analysts in a chat. A third assistant, Firewall Assistant, is available for firewall rules and policies. It uses data from a selected, centrally managed Sophos Firewall and is covered separately below.

The complete AI Assistant in the XDR investigation workflow requires Sophos XDR, Sophos MDR, Sophos MDR Plus, or Sophos Network Detection and Response. Sophos EDR includes AI Case Summary, AI Command Analysis, and AI Search, but not the XDR AI Assistant. These XDR licence details make no statement about Firewall Assistant licensing. According to Sophos, full access to the AI features requires the Super Admin or Admin role. Inputs and outputs are currently supported only in English.

Choose the right tool

• AI Search: Searches data in the Sophos Data Lake. In the Classic view of Threat Analysis Center, select Detections or Endpoint Data; Endpoint Data searches there are limited to Windows. Under Security Operations > Data Lake Search, AI Search instead generates Advanced Search queries in QL. The Windows restriction of the Classic workflow is not applied to this new search interface.
• Security Analyst: Investigates a specific Sophos-managed or Self-managed Case and inherits its Case and Detection context.
• Threat Hunter: Hunts for actors or indicators of compromise in the Data Lake and works only with Self-managed Cases.
• Firewall Assistant: Supports firewall rule configuration and policy analysis for a firewall managed in Sophos Central running SFOS 23.0 or later. The chat starts by selecting a firewall, not a Case ID.
• AI Case Summary: Summarises a Case’s Detections, devices, users, MITRE ATT&CK tactics, and possible next steps.
• AI Command Analysis: Explains and de-obfuscates command lines from Detections.

The XDR investigation assistants Security Analyst and Threat Hunter can currently retrieve and analyse XDR-integrated data from Sophos Endpoint and Sophos Server on Windows. They can’t remediate a threat or perform a Response action. Isolation, Live Response, blocking, authorisation, and closing a Case remain deliberate human decisions. These Windows data sources and Response boundaries describe the investigation workflow, not firewall configuration with Firewall Assistant.

Use AI Search safely

First check which interface your tenant uses. Threat Analysis Center is the still-available Classic view of Security Operations. The SQL workflow below belongs to that Classic view; the new Data Lake Search is described separately afterwards. A new menu entry is no reason to rewrite working Classic queries without checking them.

Classic: AI Search in Threat Analysis Center

1. Open Threat Analysis Center > AI Search.
2. Select Detections or Endpoint Data on the left. Endpoint Data requires a Windows device.
3. Select a suggested search or enter a question in English. Specify the device, user, indicator, and time range as precisely as possible.
4. Select Search and review the results table.
5. Expand Generated Query and inspect the generated SQL. Its data source, fields, filters, and time range must match the investigation question.

Without an explicit time range, AI Search defaults to 24 hours. Sophos recommends starting with a few hours or no more than one day, then expanding gradually. Queries spanning days or weeks can become slow or time out, depending on data volume.

The results table shows no more than 1,000 matches. Sophos states that Data Lake data is retained for 90 days, or one year with the Central Data 1-Year Storage Pack add-on licence. A 1,000-row result therefore doesn’t prove that exactly 1,000 events exist, and an empty table doesn’t prove that no activity occurred during the complete incident period.

Use Save Query to store a useful query in the new AI Search category in Live Discover, or Export to download its SQL and results as CSV. Sophos Live Discover and Data Lake queries explains the difference between Live Endpoint and Data Lake, as well as operational query limits.

Security Operations: AI Search in Data Lake Search

Under Security Operations > Data Lake Search > AI Search, enter an investigation question in natural language or select a prepared prompt, then select Search. Browse Prompts or View All opens the prepared prompts; Sophos Only, category chips and the search narrow the selection. Once loaded, a prompt can be adapted to the device, indicator and time range of your investigation.

Below the results, the generated query appears in the Advanced Search query language, called QL here, rather than the Classic SQL query from Generated Query. Check the data source, fields, filters and time range against the investigation question. If the result does not fit, refine the prompt and select Search again. The Classic row limit and Windows restriction are not established limits of this interface.

Save Query requires a name and category; a description and Bookmark this Query are optional. Save with Save Query, then check under Saved Queries that you can find the query again. The Data Lake Search section of the query runbook describes the complete workflow with Query Builder, Query Editor, search history and export.

Start AI Assistant from a case

The following case entry point describes the Classic view. Security Operations also has Cases; this does not establish that the same button, tabs or chat handoff are available there. This article covers the XDR investigation assistant, not a general endpoint helper or Sophos AI Defense features.

The safest entry point is a reviewed Case rather than a context-free chat:

1. Open Threat Analysis Center > Cases and select the Case ID.
2. Review the Detection, affected devices, and relevant time range.
3. Select Ask Sophos AI in the upper right. Central opens Security Analyst with the Case context.
4. Edit a predefined prompt or ask your own question in English. Enter / to open prepared and saved prompts.
5. Ask follow-up questions in the same chat. Assistant considers the current thread; a new chat doesn’t have that conversation context.

Alternatively, open AI > Assistant, select New, then Security Analyst or Threat Hunter. Security Analyst then asks for a Case ID. Ask AI can also add selected rows from a results table as context for a follow-up. Before sending, verify which selection will actually be transferred.

Firewall Assistant: select a firewall and continue working

Firewall Assistant in Sophos Fusion supports SFOS 23.0 or later and requires a centrally managed firewall. The minimum version alone does not promise general availability in every tenant or build; actual availability and approval of the target build must suit your environment. This configuration chat is not the local Sophos Assistant in WebAdmin for documentation searches and guided workflows.

Under AI > Assistant > New > Firewall Assistant, a list of firewalls managed in Sophos Fusion appears. Devices running older SFOS versions are greyed out and cannot be selected for this workflow. Each chat belongs to exactly one firewall. Start a separate chat for another device; several chats for different firewalls can exist alongside one another. Data access remains limited to the signed-in administrator’s permissions for the respective firewall.

1. Check the name and firmware version of the intended firewall and select its entry. This starts the chat with the correct device rather than a Threat Case.
2. Select a predefined prompt or enter your own question in English. Enter / to display more prepared prompts; select Send to send the question.
3. Check the response against the selected firewall’s rules and policies. Follow-up questions in the same chat retain the conversation context. After closing the page or selecting New, the previous chat remains available in the list on the left and can be reopened there.

If a device is greyed out, check its SFOS version first. If it is missing from the list, check that it is centrally managed and that you are in the correct tenant. Do not upgrade the firmware merely to unlock the assistant; the target build and upgrade approval must be appropriate for your environment.

For the operational transition to rule management, the Sophos Firewall v23 overview explains the AI assistant and the importance of rule position. A chat response is not authorisation to activate a rule in production. The target firewall, objects, rule position, and security checks must be deliberately reviewed before every change; neither selecting the assistant nor successfully submitting a prompt implies autonomous activation.

Review the rule draft, apply it under control and audit the action

In the documented Phase 1 scope, actions focus on firewall rules and are read-only, with one exception: a prompt can create a new firewall rule. The Assistant first displays a draft with a JSON summary and views of the objects used. Only after confirmation is the rule created on the firewall, by default disabled at the bottom of the rule table. This is already a configuration change, but not yet an effective traffic allowance.

⚠️ Use a creation prompt only for a planned and authorized change. Before confirming, record the target device, existing rules and objects, and the current configuration state. Later activation can allow or block traffic; the intended packet flow, security inspection, maintenance window and recovery path must therefore be agreed in advance.

1. In the correct firewall’s chat, specify the required IP version, existing object names and intended packet flow precisely. Answer clarification questions rather than granting blanket access to entire networks or arbitrary services.
2. In the preview, compare the JSON summary and object views with the intended rule: source, destination, services, action and security options must match. If they do not, have the draft corrected or do not confirm it.
3. Confirm creation only after reviewing the draft. Then, independently of the chat, open Rules and policies in WebAdmin on the same firewall and check the appropriate IPv4 or IPv6 rule list. Expect the new rule to be disabled at the bottom of the table. If it is missing or its state differs, do not blindly create it again or activate it; reconcile the device, list and creation confirmation.
4. Check the settings actually saved and the required objects. Only after approval, set the technically appropriate rule position and activate the rule manually. A suitable rule at the bottom of the table may be ineffective because of an earlier rule; one placed too high can bypass the intended restriction. Test both allowed and still-blocked packet flows using the rule test with Log Viewer, Policy Test and Packet Capture.
5. To obtain evidence of the Assistant action, open Log Viewer through Logs and policy test and filter by the AI Assistant component. Reconcile audit events with the target firewall, change time and rule actually saved. The audit entry proves the Assistant action, not the correct effect on packet flow. If the expected entry is missing, check the period and filters and investigate the discrepancy rather than assuming there was no change.

If the effect is unexpected, disable the newly activated rule again and check the previously documented state. Disabling the rule removes neither the draft nor any newly created objects and is not a full configuration rollback. A draft that has not been approved remains disabled; check its object dependencies before any later cleanup.

Write a defensible prompt

A good prompt states the objective, scope, and required output. For example:

Compare the detections for endpoint WS-023 during 10 September 2026, 08:00-12:00 UTC. List process names, command lines and hashes, and mark every conclusion that still needs validation.

WS-023 is a neutral example and must be replaced with the device under investigation. Date, time, and time zone must match the Case. Add process names, IP addresses, users, or hashes only when the hypothesis requires them. Saved prompts need a clear alias; both alias and complete prompt must be unique. An owner, purpose, and review date prevent an outdated prompt from becoming an unreviewed Runbook.

Validate and document results

AI responses can be false or misleading. Check claims such as “no other devices are affected” against the Case timeline, Detection details, device data, and query results. In particular, confirm:

• Does the evaluated time range, including its time zone, match the Case?
• Was the affected device providing telemetry during that period?
• Do filters, platform support or, in the Classic AI Search workflow, the 1,000-row limit constrain the claim?
• Do raw events support the proposed conclusion and Response?

Responses, individual table rows, complete tables, and queries can be pinned. These Pinned Items remain in the Workbench for the duration of the chat and can include a rationale note. They are a personal working aid, not Case documentation. Feedback buttons rate the specific response; confidential incident details don’t belong in the optional comment field.

You can add one or several verified results from Security Analyst or Threat Hunter to the Case’s Notebook tab. This Case-Notebook workflow is not documented as a transfer method for Firewall Assistant. For a single response, use the plus icon below the response, then confirm the addition. For several responses, use three-dot menu > Select responses > Add to case. With Threat Hunter, you must select the target Case; Security Analyst uses the Case already under investigation.

A private chat is visible only to the person who started it. Other administrators with Case access see only responses added to Notebook. Use the three-dot menu beside the chat title and select Delete to remove the complete thread. Validate required evidence against raw data and record it in the Case or your incident system before deletion; the chat isn’t an audit-proof archive.

Privacy and usage limits

Passwords, private keys, recovery codes, and unnecessary personal data don’t belong in prompts or feedback. Limit context to the investigation question and continue to apply your organisation’s data-classification, retention, and export rules.

The XDR AI features use Azure OpenAI and Amazon Bedrock. Inputs and outputs aren’t used to train the models or improve the third-party services, and all data transferred to third-party LLM services is encrypted in transit. Existing role-based Central permissions continue to constrain which data a user can access. Before enabling these features, responsible teams should review the current data-processing and subprocessor details in the XDR Privacy Data Sheet.

Published limits for the XDR AI features described here apply over a rolling 24-hour period; no separate Firewall Assistant limits are inferred from them:

• AI Command Analysis: 50 per user, 250 per tenant
• AI Search: 20 per user, 100 per tenant
• AI Case Summary: 10 per user, 50 per tenant
• AI Assistant threads: 20 per user, 100 per tenant
• individual Assistant messages: 200 per user, 1,000 per tenant

When a limit is reached, the affected feature pauses with HTTP 429. Sophos can change these values, so use the current limits page for operational planning. Critical investigations must always retain a manual path through Cases, Detections, Live Discover, and the underlying telemetry.

Frequently asked questions