Analyze Sophos events for computers and servers

Sign in to Sophos Fusion (formerly Sophos Central) to access events and reports. This article covers the Events Report, events on individual computers and servers, the Computer Report, and the 30-day protection overview. Alert processing and XDR investigation are intentionally separate workflows.

Choose the appropriate view

• What happened when? Open the Events Report.
• What happened on a particular computer? Use the Events tab in the computer details.
• What was detected on a particular server? Use the Events tab in the server details.
• Which computers are managed and when did they last report? Use the Computer Report.
• What does the protection overview of the last 30 days look like? Open report Overview of your Sophos protection.

An event is a logged occurrence. Events requiring action can also appear on the Alerts page. After you take action on or ignore an alert, the underlying event remains in the event list. The event view therefore provides a history, but it isn’t a complete incident investigation by itself.

Evaluate events tenant-wide

The events report can be accessed at Reports > General Logs > Events. For a reproducible evaluation, proceed as follows:

1. In Search, enter a user, device, or threat name. Sophos does not support searches for a filename mentioned in an event.
2. Select a period under Choose period. For Custom, From and To are set; the view goes back a maximum of 90 days.
3. Under Event type and count, select or clear categories or individual event types. By default, all events are visible.
4. Load newly received events with Update. The graph shows the number of events per day.
5. Review the result and, if necessary, save the settings with Save as Custom Report or use Export to create a CSV or PDF file.

The event list includes Sev, Date, Event, User, User Groups, Device, and Device Group. A saved custom report is personal: only the administrator who created it can see it. Partner and Enterprise administrators can’t see or create it. The export menu offers either the current view or the past 90 days. Record the search term, period, and selected event types in the operational documentation so that later exports remain comparable.

Check events on a computer

For a computer, go to My Environment > Computers & Servers or My Products > Endpoint > Computers. Open the computer name and select the Events tab. The list shows severity, the Sophos agent that reported the event, and—where available—Details. View Events Report arranges events by type and shows a day-by-day graph.

An event can have a later timestamp than Last active in the computer list. That’s not necessarily a contradiction: Sophos only updates Last active once an hour on average.

Some event details provide actions for a suspected false positive. Such allow rules or exclusions can have a broad scope and shouldn’t be created solely because a filename looks familiar. Follow the verification and cleanup process in Sophos Endpoint threat cleanup and malware remediation.

Check events on a server

For a server, go to My Environment > Computers & Servers or My Products > Server > Servers. Open the server name and select the Events tab in the server details. The list shows Sev, Type (the reporting Sophos agent), Date, and Event; Details is not available for every event. View Events Report shows events by type and in a day-by-day graph.

For Unauthorized File Protection (UFP) on Windows servers, Monitor execution of unauthorized files without blocking reports unauthorized execution without blocking it; Block execution of unauthorized file blocks it. Investigate the server event and, where available, Details. To verify that a file was blocked, match a reported block event in Summary or Events against the policy setting applied to the server. An event reported in monitor mode is not proof of blocking. Use Reports > General Logs > Events for a specific time period.

Read event types correctly

The event types shown depend on the licensed features. Use this operational mapping; the names and values below are the values shown by Sophos Fusion:

• Malware and PUA: Running malware not cleaned up (High), Malicious activity detected (High), Remotely-run ransomware detected (Medium), Ransomware attacking a remote machine detected (High), Safe Browsing detected compromised browser (High), Behavioral (Low), AMSI protection could not clean up a threat (High), Malware not cleaned up (High), Recurring infection (High), Potentially Unwanted Application (PUA) blocked (Medium), and Potentially Unwanted Application (PUA) not cleaned up (Medium) have Action required? = Yes. First isolate the affected device when indicated, open the alert and details, and complete the stated manual cleanup, scan, or reboot. Confirm a cleaned-up/resolved event or a clean technical state afterward; a detected or blocked event alone isn’t proof of remediation.
• Management: Reboot required (Medium), Policy non-compliance (Medium), Real-time protection disabled (High), Failed to protect computer or server (High), Device de-duplicated (Low), and Active Directory synchronization error (High) have Action required? = Yes. Perform the requested reboot or correct the policy, protection, group/policy assignment, or synchronization fault, then verify the corresponding compliant, re-enabled, protected, or successful state. Update failed is Low with Action required? = No, but first verify connectivity and that a later Update succeeded event appears. A policy-noncompliance alert appears after more than 2 hours, a disabled-real-time-protection alert after 2.5 hours, a failed-protection event after 1 hour, and an unresolved Active Directory synchronization failure alert after more than 1 hour.
• Network access: Peripheral detected (Medium) and Missing heartbeat reported (High) have Action required? = Yes. Check whether the peripheral is authorized; for a missing heartbeat, treat continued network traffic as potentially compromised, check any firewall restriction, and verify Restored heartbeat reported after remediation. Peripheral allowed, Peripheral restricted to read-only, Peripheral blocked, and Restored heartbeat reported are Low and don’t require action by themselves.
• User behavior: Web policy events, Web threat events, and all download-reputation events are Low with Action required? = No. Use the relevant web report for the user, policy violation, or malware download; for User trusted low reputation download and Low reputation download automatically trusted, confirm that the decision and, for automatic trust, the Log only setting were intended. DLP records state whether a controlled transfer was accepted, allowed, or blocked; they don’t publish severity or Action required? values, so verify the transfer against policy rather than inferring priority.
• Device encryption: Key creation failed, Device Encryption failed, Device not encrypted, Device Encryption is suspended, and Recovery key missing are Medium; Device Encryption information, Device Encryption status changed, Received recovery keys, and Revoked keys are Low. Their Action required? value is See Note: for most encryption alerts, restart the computer and let it synchronize with the server, then verify the encryption status or recovery-key state. A viewed recovery key is revoked and replaced.

The event name alone therefore doesn’t determine priority. Check at least the severity, Action required? value, affected device, time, and details. Alert triage remains in the separate article Manage Sophos Endpoint alerts and Account Health.

Use the Computer Report for inventory questions

Under Reports > Endpoint & Server Protection > Computers, the Computer Report lists all computers managed by Sophos Fusion. Its columns answer specific inventory questions:

• Online: time of last status message; the display is updated on average every hour.
• Last user: last user to sign in and how long ago; after a different user signs in, this information is refreshed within an hour on average.
• Last update: time of the last Sophos software update.
• Group: assigned computer group.
• Agent installed: whether Sophos software is installed.

The report is therefore suitable for device hygiene and tracking. However, Online is not a second-by-second availability test. A supposedly inactive device is first compared with event times and the expected reporting interval.

Interpret the 30-day protection overview

Under Reports > Endpoint and Server Protection > Hero Reports, open Overview of your Sophos protection. The report is available to Admins, Super Admins, and Partners and summarizes the past 30 days. It shows, among other things, blocked threat events, protected assets, blocked or warned websites, protected users, computers and servers, and license usage.

The limits are important: the period can’t be changed, the report summarizes only one estate, and it can’t be scheduled. It doesn’t show license usage for Enterprise Master Licenses. Export as PDF downloads the current report as hero-report.pdf. The report is suitable for a management overview, not as a complete incident record or a replacement for the event list.

Don’t confuse Event Journals with events in Sophos Fusion

Event Journals are stored locally on managed Windows, Mac, and Linux devices and queried with Live Discover Endpoint queries. There is no fixed retention period: the platform, endpoint activity, and configured size threshold determine when the oldest journals are deleted. Configuring journal size requires XDR, MDR, or MDR Plus. Under Global Settings > Products and Services > Endpoint and Server > Event Journals, select the Endpoint or Server tab. Maximum journal size (MB) accepts 300 to 30,000 MB and defaults to 5250 MB. Maximum disk space (optional) offers Not specified, 10%, 20%, 30%, or 40% and defaults to Not specified; if both limits are set, the lower one applies.

These settings are global for all endpoints and servers and can’t be adjusted per device. Lowering either limit may discard some journal data and reduce the history available to Live Discover across all devices. After a controlled rollout, query representative endpoints and verify that the available local history meets the intended investigation window.

Event Journals are therefore neither a longer-retained Events Report nor a source with a guaranteed history window. Investigations of raw activity with Live Discover belong to the separate XDR workflow in Investigate Sophos Endpoint detections and Threat Graphs.

Frequently Asked Questions