Sophos Endpoint Threat Protection best practices

The Threat Protection policy is the most important Endpoint policy in Sophos Central. It controls not only traditional malware scans but also behavioural detection, exploit mitigation, CryptoGuard, web protection, Event Journals and other runtime protections.

Sophos-recommended settings are the best starting point. Keep deviations small, targeted and measurable. A broadly weakened Base Policy may fix compatibility briefly, but it enlarges the blind spot for every endpoint.

Baseline before fine-tuning

First identify the effective policy under My Products > Endpoint > Policies > Threat Protection, then answer:

1. Which platforms and agent modes receive it?
2. Do its settings match current Sophos recommendations?
3. Are deviations and old exclusions documented?
4. Are Event Journals and Threat Graphs available for investigation?

Account Health Check highlights important deviations. Automatic repair is available but should first be tested with a pilot group.

Protection areas and recommendation

The detailed list grows with agent versions. Compare the current policy with Sophos recommendation markers rather than treating an old screenshot as permanent truth.

Real-time and download protection

Real-time scanning checks files on access. Download Reputation additionally evaluates downloads by source and prevalence. Recommended automatically blocks low-reputation files. Strict also blocks medium-reputation files and can affect more legitimate downloads.

Test Strict in a pilot group first. Base the decision on real download workflows and events, not merely on choosing the strictest switch.

Sophos Live Protection checks the current reputation of unknown files with Sophos. Deep Learning uses its model to detect suspicious files even without traditional signatures. Both functions remain part of the baseline.

Limits of Download Reputation

Download Reputation is a Windows feature for files downloaded through supported browsers. Firefox downloads are currently not assessed through this path. Sophos derives reputation from hash, prevalence, age and source URL; full reputation queries mainly apply to executable files or files recognised as applications.

The query uses SXL4 over HTTPS. Scheduled scans can send hash information to Sophos and populate a local cache, but do not enforce a Download Reputation decision. The cache is limited to 200 MB and then removes older entries.

⚠️ If the endpoint cannot reach SXL and the query times out, the download is allowed without a reputation prompt. Download Reputation therefore does not replace file scanning, Deep Learning, or working network and proxy requirements.

For troubleshooting, distinguish three changes: set the action to Log only, disable Detect low-reputation files, or disable Live Protection and therefore the online query. Their security impact differs. Use them only in a small test policy with a fixed rollback time, never as a permanent workaround.

The policy distinguishes local, network and removable media. Scan network drives only as broadly as the business process requires because duplicate scanning on client and file server can reduce performance. Removable media and newly downloaded files remain important entry paths.

Internet scanning can inspect HTTP downloads directly. For encrypted HTTPS, visibility depends on SNI and enabled SSL/TLS decryption. A successfully blocked HTTP test therefore does not prove equivalent content inspection for HTTPS.

Cleanup and SafeStore

Sophos can clean detected malware automatically. Windows cleans detected items regardless of the visible setting. Cleaned files are held in SafeStore and can be restored through a controlled allow process.

Restoration is not a routine user action. Verify the detection name, source, hash, signature, business need and SophosLabs assessment first. Sophos Endpoint threat cleanup and malware remediation explains the false-positive process.

SafeStore has fixed limits: an individual file can be no larger than 100 GB, and no more than 200 GB or 2,000 files are retained in total. These limits are not a backup strategy. Business data must be backed up independently.

Event Journals and Threat Graphs

Keep Enable event journals on. Journals provide activity data for Threat Graphs, Live Discover and Forensic Snapshots.

Turning them off removes data for the exact period that may later require investigation. Enabling them afterwards cannot reconstruct missing history.

Enable Threat Graph creation helps reconstruct the chain of events around a detection and belongs in an XDR and incident-response baseline.

On Windows, Sophos Data Recorder uses the shared NT Kernel Logger session. If another tracing tool reports 0xb7 or “file already exists”, that session is occupied. Disabling Enable Threat Graph creation releases the logger but also stops Threat Graph generation. Use this only as a documented, time-limited diagnostic window, then re-enable the policy and verify telemetry.

Ransomware protection

CryptoGuard protects documents against unauthorised encryption. Protection from remotely run ransomware should also remain enabled because a compromised device can encrypt files on network shares.

Additional options protect against EFS and master boot record attacks. A ransomware detection requires investigation of the device, user, source process, network shares and neighbouring systems, not just the individual file.

Runtime Protection and exploit mitigation

Depending on platform and agent version, Runtime Protection can include:

• protection against process hollowing and DLL injection
• blocking untrusted DLL paths
• credential-theft protection
• protection for MFA browser cookies
• detection of malicious beacons
• protection against ETW tampering
• monitoring of abused drivers and system calls

Do not disable individual protections simply because an application crashes. First associate the event with a protection component and narrow the issue using a pilot or targeted policy exclusion.

Other current areas include AMSI Protection for script and memory content, Intrusion Prevention for malicious network traffic, Driver Detection and protection events on Domain Controllers. IPS is not enabled by default in the Endpoint policy and should therefore be piloted deliberately. It inspects inbound and outbound traffic on the Windows device and is not the same as IPS on a network firewall.

Block QUIC browser connections forces supported browsers away from QUIC so that web controls see the intended path. Test current browsers, video conferencing and web applications before enabling it.

Adaptive Attack Protection

Adaptive Attack Protection automatically strengthens defences when Sophos detects an active attack. Additional protections can remain permanently enabled, including Safe Mode protection, vulnerable-driver blocking and additional audit policy logging.

Older specialist drivers and administrative security tools need careful piloting. Address incompatibility with a tightly scoped exception rather than disabling the entire area globally.

If Self Help reports that Anti-Ransomware and every Exploit Mitigation feature are disabled by policy, verify the effective Threat Protection policy. Registry values such as disabled KernelFeatures or NoCryptoGuard describe the resulting local state, but are not the repair location. Correct the policy in Central and verify locally after synchronisation.

Disrupt detections and Safe Mode

A detection prefixed Disrupt_ means Adaptive Attack Protection interrupted behaviour that may belong to an active attack or penetration test. Before an exclusion, review device, user, detection, TTP classification and planned test together. If legitimate, authorise the specific rule instance where possible. Globally disabling Adaptive Attack Protection is the last option. It prevents further Disrupt_* rules, while TTP classifications for XDR remain.

Block safe mode abuse prevents suspicious programmatic Safe Mode activation as Prevent_1a (T1562.009). The rule does not clean malware; it only blocks the transition. For planned maintenance, temporarily disable the setting on that device using Override Sophos Central Policy, use a narrow device policy, or start Safe Mode from an authorised Live Response session. A local override expires after four hours but should still be ended deliberately.

Do not permanently authorise a single Prevent_1a detection because an attacker could later reuse the technique. After maintenance, recheck policy, Tamper Protection and Health State.

Additional Windows audit logging

With Core Agent 2026.1, Sophos enables Enable additional audit policy logging by default. It extends the Windows Security Event Log with Events relevant to Detection and Threat Hunting, including Kerberos sign-ins, account and group changes, logons, scheduled tasks, Credential Manager access, service installations and audit-policy changes.

The underlying Event list cannot be configured individually. On Domain Controllers, terminal servers and other heavily used systems, the Security Log can therefore grow considerably faster. Check SIEM ingestion, retention, Event Log size and existing Windows audit GPOs before a broad rollout.

The switch can be disabled, but doing so reduces the data available for advanced Detection and Threat Hunting. Disable it only after measuring the impact and documenting the trade-off, not merely because the Event count increased.

HTTPS decryption

Decrypt websites using SSL/TLS enables content inspection of encrypted websites. It is off by default and can slow browsing or interfere with certificate-pinned applications.

Deployment requires privacy and compliance review, a pilot with important browsers and business applications, review of sensitive categories and a documented exclusion process.

Multiple decryption layers on the endpoint and other security services can create unnecessary complexity. Choose the inspection point deliberately. This article covers only the Central Endpoint policy.

Scheduled Scan

A weekly scheduled scan can inspect rarely used data. The configured time is the endpoint’s local time. If the device is off, it waits until the next scheduled time.

Scheduled scans do not replace real-time protection. The current background option is limited to Windows. A missed scheduled scan does not run repeatedly without limit; test the exact behaviour of the selected scan option on an offline pilot. For mobile devices, select a time when they are usually online without unnecessarily affecting core working hours.

Exclusions

Policy exclusions affect only that policy’s target and are preferable to global exclusions. Every exclusion reduces protection and must be as specific as possible.

Broad drive, profile, temporary-folder or process exclusions are particularly risky. Configure Sophos Central Endpoint exclusions safely covers types, wildcards and lifecycle control.

Development tools such as WinDbg Time Travel Debugging cannot attach to protected processes while Exploit Mitigation is active. If required, give only the investigated process a time-limited Exploit Mitigation and Activity Monitoring exclusion in a separate device policy. Remove or disable that policy after capture and verify protection again.

Pilot and acceptance

After a change, verify the effective policy, health and compliance, new events, business workflows, performance, browser behaviour and availability of Threat Graph and Event Journal data on pilot devices.

Only then expand the target group in stages. When problems arise, isolate the last change instead of resetting the whole policy to an unsafe state.

Acceptance should include a test file as well as a controlled web download, removable medium, network path and legitimate process with elevated exploit risk. This validates the actual protection chain rather than only one scanner switch.

Frequently asked questions