Block compromised IP addresses with Sophos Endpoint

Sophos Fusion (formerly Sophos Central) can prevent managed Windows and Linux devices from communicating with specified internal or external IPv4/IPv6 addresses and CIDR ranges. With Block compromised IP addresses, the administrator specifies which addresses to block. Validate the indicators before saving; the feature name alone does not establish that an address is compromised. This feature does not support macOS.

Choose the correct enforcement point first

Use this list when managed Windows and Linux endpoints must stop communicating with a confirmed IP indicator. Use a different control for these tasks:

• One suspicious endpoint: Isolate the device and investigate the incident. The IP list replaces neither containment nor remediation. See Isolate Sophos Endpoint and investigate with Live Response.
• All systems behind a gateway, including unmanaged devices: Block the IP on Sophos Firewall or the responsible network gateway. The Central list protects only supported managed endpoints.
• A host on Sophos Switches or AP6 access points: Use Active Threat Response. It handles isolated hosts or MAC addresses and is not this IP destination list.
• An MDR/XDR action or threat feed: That is a separate response workflow. Sophos requires a Central administrator role for this manual list, but its instructions do not require an XDR step.

Assess impact before saving

Only block an address after checking the source, observation window, and affected connections. With shared web hosting, CDNs, NAT, or cloud services, one IP can serve many legitimate services. A broad CIDR block increases the potential impact.

Critical targets include servers, DNS and identity services, management systems, Update Caches, and Message Relays. The Central form documents no port, protocol, application, or allow-exception selector for an entry. Prefer an exact IP to a network, assign an owner, and set an expiry for temporary indicators.

Block an IP address in Sophos Fusion

You need a Sophos Fusion administrator role. According to Sophos, Help Desk users cannot use this feature.

1. Open the Global Settings icon.
2. Go to Protection and Remediation > Allow and Block > Network > Block compromised IP addresses.
3. Turn on Block communications with specified IP addresses.
4. Click Add and enter an IPv4 address, IPv6 address, or CIDR range under Address.
5. Under Expiry, choose the required duration. The default is 7 days; 30 days and No expiry are also available.
6. Under Comment, record at least the IOC source, ticket, owner, and purpose. The field is optional, but it makes later review much safer.
7. Click Confirm. Add further entries individually if needed.
8. Click Save in the upper-right corner. This final step saves the global list.

The interface supports up to 500 addresses or ranges, added individually. For larger response operations, Sophos points to the Endpoint API. Its POST /settings/blocked-addresses/bulk operation requires an X-Tenant-ID header and accepts up to 100 addresses or ranges at the same time; each item can include a comment and an expireInDays value from 1 to 365. Authenticate against the tenant’s regional Endpoint API as documented by Sophos rather than applying the UI role requirement to an API client.

There is an important platform discrepancy in the current Sophos documentation: the Central feature page says Windows and Linux, while the Endpoint API’s bulk-operation description says the operation is only available on Windows devices. Confirm the required Linux behavior with Sophos before relying on API automation for it. Keep payloads in a tested workflow; do not bypass the UI limit with unverified scripts.

Operational recommendation: Use 7 days first for a short-lived IOC. Reserve No expiry for permanently prohibited infrastructure and review it regularly. Expiry does not replace incident documentation.

Validate globally and roll back safely

Because there is no group scope, you cannot safely enable the real IOC only on a pilot device. Instead, test the mechanism in advance with the exact IP of a dedicated, disposable test destination:

1. From a managed Windows or Linux test device, confirm that the test destination is reachable before the change.
2. Add only that test IP with 7 days and an unmistakable test comment, then click Save.
3. After the endpoint’s next successful Central communication, repeat the same access. The managed device should no longer be able to communicate with the destination.
4. Test from an unmanaged control device. The connection should still work there, separating endpoint enforcement from a target outage or firewall rule.
5. Select the test entry, click Delete, and then Save. Confirm that the managed device can connect again.

For the real IOC, identify affected applications and expected business connections before saving. Notify the service desk and incident owner during rollout and prepare immediate removal.

Troubleshoot by symptom

The connection still works

• Confirm that Block communications with specified IP addresses is on and that you clicked Save after Confirm.
• Check that the device runs Windows or Linux. macOS is unsupported.
• Verify that the endpoint can reach Sophos Fusion and receive current changes.
• Resolve or inspect the destination actually used by the application. A hostname can return several IPv4 and IPv6 addresses; this list blocks IP addresses, not domain names.
• Check the address, IP family, and CIDR prefix for mistakes. Do not immediately widen the network range.

Sophos publishes neither a fixed propagation time nor a dedicated event or minimum agent release on the feature page. If access still works despite a correct list and healthy Central communication, capture the time, endpoint, destination IP, and test method and escalate to Sophos Support.

A legitimate service stops working

Select the specific entry, click Delete, and Save. Verify recovery from the affected managed endpoint. Do not leave the whole feature disabled: compare the IOC and destination IP with DNS resolution, shared hosting, CDN use, and service dependencies, then apply a narrower block or use the more appropriate enforcement point.

An IP block does not close an active incident. Continue to isolate affected devices and investigate processes, persistence, credentials, and other destinations.

Frequently asked questions