Investigating Sophos Endpoint detections and Threat Graphs

A Detection shows unusual or suspicious activity that Sophos has not already blocked as a known threat. It is therefore an investigation signal, not proof of successful prevention or a confirmed incident. Threat Lineage visualises the processes that led to a Detection. For a malware detection, a Threat Graph shows the Root Cause, attack path, and affected artefacts.

The safe short workflow is: scope the Detection, read the details and raw data, inspect the Lineage or Threat Graph, search for similar occurrences, and only contain or remediate when there is sufficient evidence. This article treats Cases and response actions only as hand-off points; custom Detection Rules, Case operations, and Live Response belong in the linked runbooks.

Requirements, platforms, and roles

The tenant needs Sophos EDR, XDR, or MDR for Threat Analysis Center > Detections and Threat Lineage. The products involved must upload data to the Sophos Data Lake. Without that telemetry, this workflow does not generate Detections.

Threat Graphs are available with Sophos Endpoint, EDR, XDR, or MDR, but currently only for Windows and Mac devices. Deep Learning detections of potentially unwanted applications (ML PUAs) do not create a Threat Graph. Sophos directs administrators to the Threat Hunting Live Discover query to search for the reported file name or SHA-256; this article does not recreate the specific query.

Viewing a graph and taking response action in it are separate permissions:

• Super Admin and Admin can request and view Intelligence Reports, view blocked items, request and view on-demand Threat Graphs, isolate and un-isolate devices, manage Clean and block, and request Forensic Snapshots.
• Help Desk can request and view Intelligence Reports, view blocked items, request and view on-demand Threat Graphs, and request Forensic Snapshots, but cannot isolate devices or manage Clean and block.
• Read-only can, with XDR, view intelligence, blocked items, and on-demand Threat Graphs, but cannot perform any of these response actions.
• A custom role needs the corresponding permission. For removing administrative isolation, Sophos explicitly requires a Super Admin, Admin, or Custom Role with that permission.

Which buttons an administrator actually sees also depends on the licence, Detection source, and Severity. If an action is missing, check these three requirements first before treating it as an interface error.

1. Triage Detections

Open Threat Analysis Center > Detections. Detections can originate from Sophos products and, through MDR/XDR integrations, from third-party products. The bar chart and list show the previous 24 hours by default. In the chart, the slider shortens or extends the visible period; hovering over a bar segment displays the number of matches, and clicking it filters by that Severity. Use the time menu to select a common or absolute range and review Severity, Type, Detection, Time, Entity, Category, Source, and the MITRE ATT&CK mapping. Type currently distinguishes Threat and Vulnerability; Category identifies the source type, such as Endpoint, Network, Firewall, Email, Cloud, ID provider, or Platform. Platform Detections correlate apparently unrelated events from multiple sources. Under Show filters, narrow the list by properties including Severity, Type, user, device, and MITRE ATT&CK Tactic. User and device names are entered as free text; Select all is available for long selection lists. Apply accepts the filters and Reset to defaults clears them. Filtering and sorting work in both grouped and ungrouped views; Severity is sorted by Priority.

Group by > Detection ID combines events that matched the same rule. Also switch to the ungrouped view when assessing scope: multiple rows may represent different devices or times for the same technique. The three-dot menu lets you open a Detection in a new tab or copy its link. When comparing findings, open several Detections in separate tabs instead of trying to remember values from changing details panes.

Initial triage answers four questions:

1. Which device and user are affected?
2. Which processes, command lines, and times belong to the Detection?
3. Is the activity expected for this user, device, and time window?
4. Are there similar Detections, additional Alerts, or other affected devices?

Click the row to open the details pane. Copy device name copies the device name, Open device details opens the device, and Detections on device shows its other Detections. Similar detections filters the main list to comparable findings. Raw Data exposes the underlying data when the summary is insufficient. Pivot options start an offered Live Discover or Data Lake query; Enrichments open available threat-intelligence sources such as VirusTotal or an existing SophosLabs Intelix report. Actions can offer a scan or Live Response depending on context. Use only the pivots offered in Central and verify their target and time range rather than copying an unverified example query. A SophosLabs assessment appears only when the anti-malware software has submitted the file or an administrator has requested current intelligence.

Typical starting points include unusual commands for discovery, persistence, evasion, or credential theft; malware Alerts such as Dynamic Shellcode Prevention; Linux runtime Detections such as a container escape; and indications of outdated software or unsafe browsers. These examples help prioritise an investigation but do not by themselves confirm an attack. Expand the MITRE tactic, check the assigned technique, and open its MITRE page if required. Then decide on the basis of the specific process and device data.

2. Read Threat Lineage

In the Detection details, open the Lineage tab and select Open Lineage Graph. Alternatively, open a Case under Threat Analysis Center > Cases and switch to Detections there. If the tab is absent, the Detection does not support the feature. If no graph is available yet, Generate is shown. Sophos automatically creates the graph when a Detection generates a Case.

The Lineage distinguishes normal processes, impacted processes, the Detection trigger, and key activities; the legend shows the symbols and count for each type. The graph contains the process path to the Detection and can also show processes and activities that branch from it. Hover over a process to see basic details and its command line, open offered Live Discover pivots from the three-dot menu on the process or beside a value under Info, and click the process for Info and Activities. An automatically created Lineage already shows activities for an impacted process; in a manually generated Lineage, Enrich initially loads three days from process start and each subsequent click adds another three days. The start of the Enrich timeline marks the date and time of the Initial Detection. Activities can be filtered by type and action and expanded to show raw data. The eye icon beside a related process displays it in the graph. The search at the top left shows matches in Info, Activities, and Matching Results. The export button writes the Lineage to CSV; if export fails, select a process first and try again.

The graph remains available for seven days. It can be regenerated while the XDR Data Lake data is retained, which Sophos describes as typically 90 days. That is not a guarantee for every tenant. An available AI comment on a command line may provide leads, but it does not replace checking the path, parent process, user, time, and raw data.

3. Analyse a Threat Graph

Open Threat Analysis Center > Threat Graphs and click a graph name. The list contains the previous 90 days and can be filtered by Device, Status, or Priority. Search finds graphs by user, device, or threat name, and the columns can be sorted. Depending on the view, the list shows Status, creation time, Priority, name, the administrator who generated it, user, device, and device type. With an MDR licence, Sophos separates automatically generated, Central administrator-generated, and MDR-generated graphs into tabs; Sophos currently describes the MDR-generated tab as unused. Without MDR, the page has no such tab split.

Work through the details page in this order:

1. Under Summary, read the Root cause, Possible data involved, device, user, and time.
2. Under Suggested next steps, check the automatically assigned but editable Priority and the Status, which defaults to New. After changing it to In progress, the Status cannot be reset to New. If the action is offered, Scan the device starts a scan; the Threat Cleanup runbook explains how to check the result.
3. Open Analyze. Show full graph is the default view and shows the Root Cause, detected item, affected applications, files, Registry Keys, and their relationships. Show direct path reduces the display to the direct route from the Root Cause to the detected item.
4. Click relevant items. Process details includes global reputation, path, name, command line, Process ID, executing user, SHA-256, start and end times, and duration.
5. If No current intelligence on this file appears, the file has not yet been submitted. Use Request latest intelligence only if the file may be submitted to SophosLabs: Central then asks the computer to upload it. The new assessment, including reputation and prevalence, normally appears after a few minutes. The scale runs from red for known malicious to green for known clean; orange can simply indicate a new file. Reputation, prevalence, and machine-learning characteristics are evaluated together with origin and behaviour.
6. Use the type selector in the graph to display only the artefact types currently needed. Then, in the Artifacts list, review at least Name, Type, Reputation, Time logged, and Interactions; clicking a name opens its details. Export the list with Export to CSV if required. Graph record shows the history since Sophos or an administrator created the graph and accepts comments about the investigation steps.
7. If the central telemetry is insufficient, select a snapshot under Analyze > Create forensic snapshot, but only after clarifying its storage location, access, and analysis method. The configuration options may not yet be available in every tenant. Local access requires the Tamper Protection password and an elevated command prompt. The isolation and Live Response runbook explains local paths, S3 upload, and conversion.

Assess advanced file intelligence

With XDR, Process details extends the basic dataset with Report summary, Machine learning analysis, Code similarity, File properties, and File breakdown. Prevalence, First seen, and Last seen describe prevalence at SophosLabs, not whether the file is benign in your tenant. The machine-learning view evaluates imports, suspicious strings, compiler, exploit mitigations, resources, packer indicators, PEiD characteristics, Bitcoin addresses, and suspicious cryptographic constants, among other factors. Code similarity compares the file with known clean and malicious files.

File properties includes details such as product, type, copyright, manufacturer, version, size, and timestamps. File breakdown shows PE sections with their size on disk and in memory, entropy, and read/write/execute properties; PE imports and exports show the DLLs and APIs used and the functions provided. No single characteristic proves maliciousness. Assess the combination of signature, origin, execution chain, behaviour, prevalence, and comparison matches, and use Search for item to check scope before considering Clean and block. An authorised administrator reviews blocked files under Global Settings > Protection and Remediation > Allow and Block > Files > Blocked Items.

Sophos automatically creates a Threat Graph when it detects malware that needs further investigation. This does not apply to every security message. In particular, ML PUA Detections do not create a graph. If a Detection has no graph, continue with its details, Raw Data, and supported Lineage rather than treating the absence as an all-clear.

An on-demand Threat Graph can only be generated from Live Discover results where Central offers the action: open Threat Analysis Center > Live Discover, select a supported query, choose the target devices for an Endpoint query or the time range for a Data Lake query, and run it. Data Lake queries always include all Endpoints. In the result, open the three-dot menu beside Path and select Actions > Generate a threat graph. The graph then appears under Admin generated. Availability depends on the query, licence, and role. Sophos Endpoint Data Collection and Live Discover explains the query fundamentals.

4. Hand off the Case and response cleanly

Cases also require EDR, XDR, or MDR. When Detections belong together or need ownership, select them under Threat Analysis Center > Detections. Actions > Add to Case assigns them to an existing Case; the Case name then appears in the Cases column and at the bottom of the Detection details pane. Actions > Create Case asks for a name, description, Severity, Status (New or Investigating), and Assignee. Sophos uses Critical for confirmed compromise or unauthorised access, High for indications of a targeted attack, Medium for activity that may not be malicious on its own, Low for findings without an indication of poor Health State or compromise, and Info typically for initial health checks.

Self-managed Cases can have the operational Status Investigating, On Hold, or Resolved; the Status can be changed before an owner is assigned. Sophos-managed Cases use Investigating, Action required, or Resolved; Action required requires customer action and notifies contacts. The detail-page header shows Severity, Status, owner, and creation, assignment, and modification times. Overview contains the summary, MITRE techniques, devices, users, and latest activities; Detections, Notebook, and History separate findings, investigation notes, and changes. In a self-managed Case, Ask Sophos AI can support the investigation; its summary and command-line analysis must still be checked against raw data and the timeline. With MDR, the MDR team writes the summary; with XDR, the customer creates it, either directly or with Sophos AI. Customers cannot change a Sophos-managed MDR Case themselves, but can exchange messages and attachments through Messages. Messages go to the MDR team and are also copied to authorised contacts.

If the Case list remains empty, first wait for automatic creation and then check whether any Detections exist at all. For Sophos products, check the Data Lake upload; for third-party sources, check the data-ingest integration. Actual Case operations are outside this investigation workflow and are covered in Operate Sophos XDR Cases and Detection Rules. Sophos Support does not investigate individual Detections; MDR is the intended service for 24/7 monitoring and response. If an active intrusion is suspected, Sophos Rapid Response is the separate paid emergency-assistance route.

Response follows only after a well-supported finding:

• For a high-priority graph and an XDR licence, Suggested next steps > Isolate this device offers isolation unless the device has already isolated itself automatically. Central management and file submission remain available.
• Search for item uses XDR to find other occurrences. If results are found, the results page offers isolation for affected devices.
• Clean and block is an XDR action for a file confirmed as malicious. It cleans the file and associated files and Registry Keys from Windows devices where they are found and blocks the file on all Windows devices. It is not a test for an uncertain assessment.
• An authorised administrator manages multiple administratively isolated devices using the Global Settings icon and Protection and Remediation > Allow and Block > Network > Admin Isolated Devices. The list does not contain devices that isolated themselves because of red Health Status.

Before removing isolation, verify other occurrences, persistence, remediation, and device state. Practical isolation and controlled terminal access are covered by Isolate a Sophos Endpoint and investigate with Live Response. For malware remediation, exploit messages, and false positives, use Sophos Endpoint threat cleanup and malware remediation.

Closure criteria

Do not close a Threat Graph solely because reputation appears benign. Record at least the Root Cause, affected devices and users, relevant SHA-256 values, scope searches, actions taken, and their results. Then verify that no further occurrences are visible, the expected devices report a plausible Health State again, and required Cases have an owner and traceable Status. Only then select the graph in the list and click Close.

Frequently asked questions