Investigating Sophos Endpoint detections and Threat Graphs
Sophos Central uses several views for security activity. An Event records an action. An Alert may require a response. A Detection shows unusual or suspicious activity that was not already blocked as a known threat. A Threat Graph connects files, processes and other artefacts from a detected attack.
These differences determine the workflow. Investigate a Detection rather than prematurely treating it as a blocked attack. Conversely, a closed Alert does not prove that the underlying threat has been remediated.
Requirements
Detections and Threat Lineage require EDR, XDR or MDR and Data Lake uploads. Threat Graphs are available with Sophos Endpoint; extended actions such as cross-device search, isolation and Clean and block require XDR.
Threat Graphs are currently created for Windows and macOS. Deep Learning PUA detections do not create a Threat Graph. For these findings, use Live Discover to search by file name or SHA-256.
Triage detections
Under Threat Analysis Center > Detections, check the period, severity, type, source and MITRE ATT&CK mapping. Grouping by Detection ID combines matches for the same rule, but must not hide different affected devices.
The first triage answers four questions: Which device and user are affected? Which processes and command lines are involved? Is the activity expected in this environment? Are there similar Detections or additional Alerts?
Quick Actions open the device details or further Detections from the same device. Pivot Queries search for a hash, process or user. Enrichments lead to SophosLabs Intelix or other threat intelligence sources. Raw data remains available when the summarised view is insufficient.
Related Detections can be assigned to an existing Case or recorded as a new Case with Severity, Status and owner. Sophos Support does not perform the specialist investigation of individual Detections. MDR is the intended model for 24/7 analysis.
An ATK/ detection identifies an attack tool such as Metasploit, Mimikatz, or Cobalt Strike. Such programs may be legitimate in an authorised red-team test, but are also used for credential theft, persistence, and lateral movement. Treat the finding as a possible active attack: examine its origin and Parent Process, signed-in user, further execution, access to other systems, and similar findings across the estate. Only a documented test matching the time justifies a different classification.
Threat Lineage
Threat Lineage shows processes before and after a Detection. A graph can be available automatically or generated manually. It remains available for seven days and can be generated again within the Data Lake retention period.
When opening it, review the trigger, affected processes and key activities. Enrich loads further activity in three-day increments. Related processes can be added to the graph, and the Lineage can be exported as CSV.
An AI comment on a command line can accelerate analysis but does not replace checking the path, Parent Process, user and context.
Analyse a Threat Graph
A Threat Graph starts with Summary and Root cause. Under Analyze, review either the direct path or the complete graph. Artefacts include processes, files, Registry Keys and IP addresses.
Request latest intelligence submits a file for current Sophos analysis. Reputation alone is not a final verdict. A new internal application may be unknown, while a signed or frequently observed program can be abused.
Process Details show the path, command line, user, SHA-256, runtime and, with XDR, static or machine learning characteristics. Only take a remediation action once the assessment is reliable.
CryptoGuard or Malicious Behavior alerts may initially lack the alert link. The endpoint usually reports the alert within one or two minutes, while Root Cause Analysis and the Threat Graph may take about 20 minutes. Search for it under Threat Analysis Center > Threat Graphs; a missing link in the original alert action does not prove that no analysis exists.
Threat Graphs are created for malware detections, not for PUA, Application Control, Device Control, or Web Control. A graph can also be absent from a malware detection when Sophos cannot determine a Root Cause. Combine endpoint events, detection data, and Live Discover queries instead of waiting indefinitely for a graph.
Investigate exploit detections correctly
CredGuard, PrivGuard, Lockdown, LoadLib, APC Violation, Code Cave, and similar messages indicate blocked behaviour, not an automatic false positive. Start with Windows Application Event ID 911 from HitmanPro.Alert. Compare Application, Process Trace, command line, Detection ID or thumbprint, and parent processes with the user’s workflow and other devices.
CredGuard protects lsass.exe from memory access. A known PAM or security application can perform the same access as credential-dumping malware, so vendor familiarity alone is insufficient: process path, signature, purpose, and exact command line must match. PrivGuard blocks privilege escalation. If a verified PAM product conflicts only with token manipulation, endpoints from Core Agent 2024.3 can disable Prevent access token manipulation specifically while retaining the other PrivGuard functions.
Lockdown prevents browser, Office, or mail processes from starting code. LoadLib particularly prevents DLLs from loading from untrusted or network paths. The safest correction is in the application design: update the plugin, launch the executable outside the browser context, or install the DLL locally. Only then consider a stable Detection ID or thumbprint exclusion, disabling only the affected mitigation for that application, and finally excluding it completely from Exploit Monitoring.
For a Sophos escalation, collect the SDU, exact reproducible workflow, affected software or file, and a test with the latest available Maintenance Release. For CryptoGuard, also include the event-journal folder requested by Sophos from the same time window. Do not create an exclusion until legitimate behaviour or a genuine false positive has been demonstrated.
Isolation and Clean and block
For a high-priority case, the device can be isolated. Central management and file submission remain possible. Necessary RDP, SSH or tool-server connections are permitted through narrowly scoped Device Isolation exclusions.
Clean and block remediates the file and associated artefacts on discovered Windows devices and adds the SHA-256 to the block list. The block list applies tenant-wide to Windows. It is not a test button for an uncertain assumption.
Under Global Settings > Protection and Remediation > Allow and Block > Files > Blocked Items, up to 5,000 SHA-256 hashes of suspicious applications can be managed. This function requires XDR and blocks applications on Windows devices only. Sophos ignores hashes for other file types and files that already have a trusted reputation.
A manually added hash blocks the application on all computers and triggers cleanup of existing copies. The reason and the administrator who performed the action remain visible. Before removing it, establish why the hash is no longer considered suspicious.
After remediation, search for further occurrences, inspect memory and persistence, and only then remove isolation. Manage multiple isolated devices under Global Settings > Protection and Remediation > Allow and Block > Network > Admin Isolated Devices.
Outbreak and reporting gap
At 100 Detections within 24 hours, Sophos creates an Outbreak Alert and reduces reporting of similar Detections. Protection continues, but complete Detection reports only resume after the Outbreak is marked resolved following remediation.
Never close an Outbreak Alert merely to tidy the list. First check the device, Root Cause, further artefacts and remediation.
Closure
The Case records the cause, affected devices, hashes, users, actions performed and verification queries. Close the Threat Graph and Alert only when no further occurrences are visible and the device has returned to a plausible Health State.
Related articles
Sophos Endpoint threat cleanup and malware remediation explains threat cleanup and false positives. For query fundamentals, see Sophos Endpoint Data Collection and Live Discover. Isolation and terminal access are covered in Isolate a Sophos Endpoint and investigate with Live Response.