Use Sophos Endpoint locally and check protection status
Sophos Central shows the intended central state. The local Sophos Endpoint interface shows what is actually installed on a specific computer, whether components are working and which Events occurred directly on that device. A reliable diagnosis requires both perspectives.
This article covers the local agent on Windows and macOS. Sophos Firewall, Sophos Mobile and Server Protection are separate products.
Open the interface and protection status
On Windows, open Sophos Endpoint from the Sophos icon in the notification area or from the Start menu. On a Mac, use the Sophos icon in the menu bar.
The home page shows security status. Green means the protection components assessed locally are healthy. It does not prove that the device has received the correct Central policy, intended Agent Mode or current software stage. Check these points additionally under My Environment > Computers & Servers.
Check installed functions
About or the product details show installed components and versions. This is particularly important when Central displays an Agent Mode such as Endpoint, XDR or XDR Sensor, but expected modules are missing locally.
On Windows, open the Sophos icon in the notification area and select About at the bottom right. On macOS, use the Sophos icon in the menu bar and select Sophos Endpoint > About. Components may have different version numbers, so record all relevant component versions for a support comparison rather than assuming there is one overall version.
XDR Sensor provides telemetry but does not include full malware protection. A separate protection product must be present and operational in this mode.
Understand local settings
The Settings page shows the protection areas used by the agent. Depending on platform and licence, these include:
- Deep Learning and Real-time Scanning,
- Web, Application and Peripheral Control,
- Runtime Protection and exploit prevention,
- Adaptive Attack Protection,
- local Computer Controls.
Sophos Central normally controls these values. Local changes are possible only after temporarily disabling Tamper Protection with a valid password. A local deviation is therefore not a permanent substitute for correcting the Central policy.
Operational rule: A setting can be changed locally for a short test. Make the lasting correction in the effective policy and then verify it again on the device.
Events and Detections
Under Events, the agent shows local protection and management Events. Filter the list by Event type and time range. This is particularly useful when Central shows only a consolidated Alert or a user reports the exact time of a block.
Detections shows detected suspicious activity and its history. Not every Detection is automatically confirmed malware. Assess the process, path, user, time, Parent Process and possible child activity. More extensive XDR investigations then take place in Threat Analysis Center.
Which actions are available locally
The local interface exposes only a small subset of Central actions. On Windows, Resolve appears for certain CryptoGuard, C2, CredentialGuard, WipeGuard, Outbreak, Core Agent and Failed Clean events. Depending on the event, Intercept X or the relevant component must be installed. Tamper Protection must also be disabled or the interface unlocked with its password.
A missing action is therefore not automatically a UI defect. Check platform, licence, installed component and Tamper Protection status first. Local Resolve does not replace incident investigation or a lasting correction of the triggering policy or application.
Central shows events but the local agent does not
The local Event list can remain empty while Central still shows events for the same device. On Windows, one known cause is a Message Trail at its 10,000-entry limit. Restrictive Web Control rules or very many Peripheral Control events can create this volume.
Do not merely clear the local Event store. First use a time-limited Message Trail or the Sophos analysis script to identify the event type filling it, then correct the noisy policy. Resetting MCS and Health data requires disabled Tamper Protection, administrator rights and targeted service stops. Because it removes protected local data, preserve an SDU and follow the current Sophos KBA or Support guidance.
Trigger an update manually
Update Now requests an update from the agent. This can help a temporarily outdated device, but does not bypass a blocked connection, broken proxy or expired licence.
After the update, check three levels separately:
- The local agent no longer reports an update error.
- Components under About show plausible versions.
- Sophos Central updates Last Active, Health and software status.
If only the local display is green while Central still reports an error, check communication, policy assignment and Agent Mode.
Scan a computer or individual file
Depending on the platform, the local interface offers a Quick Scan or Full Scan. On Windows, a file or folder can also be scanned through the context menu.
A scan complements Real-time Protection; it does not replace it. It is useful for a specific suspicion, after Cleanup or when validating a newly installed device. Before a large Full Scan, consider CPU, I/O and working-hours impact.
For automated Windows scans with exit codes and JSON output, see Scan Sophos Endpoint from the CLI.
Clean up a detected threat
When the agent reports a threat, first determine whether it was cleaned up automatically or only detected. Run another scan only after assessment. Recurring Detections, running malware, ransomware or malicious network traffic require isolation and incident triage rather than repeated dismissal.
Do not create an exclusion merely for convenience. The full process is covered in Sophos Endpoint Threat Cleanup and malware removal.
Blocked file transfer
File transfer blocked usually originates from Data Loss Prevention or another control function. During a transfer of several files, the notification may concern a subset while other files transferred successfully.
A toast notification on its own means the policy does not permit user approval. A dialog with Allow and Block, by contrast, belongs to the Allow transfer if user confirms action. Allowing it locally is a logged exception for that specific transfer, not a permanent DLP policy change. If only some files in a multi-file transfer are challenged, the dialog applies to the listed files; files already permitted may still have been transferred.
Record the filename, destination, application, time and user. Then find the corresponding Event in the DLP Event Log and check the effective DLP policy. Broadly allowing the target application would conceal the cause.
Restore access to the computer
After a misconfiguration, Web, network or Peripheral rules can impede access. As long as the device reaches Central, correct the faulty policy first and wait for synchronisation.
If communication is no longer possible, local administrator access and possibly the device-specific Tamper Protection password are required. Physical access may be necessary, particularly when network adapters are blocked. Document the recovery so the same policy is not deployed again.
Capture network traffic directly on the endpoint
For reproducible connection failures such as agent-based ZTNA, open About > Endpoint Self Help as administrator and start Tools > Packet Capture. Temporarily disable Tamper Protection, reproduce only the concrete failure and stop the capture immediately afterwards.
Self Help stores ETL and PCAPNG files under C:\ProgramData\Sophos\Endpoint Self Help\PacketCapture. They may contain internal addresses, DNS names and payload data and must be protected accordingly. Technical limits, UAC requirements and size controls are documented in Diagnose Sophos Endpoint with Self Help and SDU.
Query protection status by CLI
On current Windows endpoints, sophosinterceptxcli.exe is located under C:\Program Files\Sophos\Endpoint Defense. It provides a supported machine-readable state and is preferable to custom registry parsing.
cd "C:\Program Files\Sophos\Endpoint Defense"
sophosinterceptxcli.exe query softwaremonitor all --json
sophosinterceptxcli.exe query configuration on_access_scan_enabled --json
Sophos Software Monitor returns status and, with --json, detailed component and version information. After first installation, the query becomes available only after the first product update, normally after about five minutes. Leave at least one second between queries. Automation must evaluate returned status, exit code and data age rather than assuming every JSON response is healthy.
query configuration returns only effective policy values Sophos exposes, currently including on_access_scan_enabled. It requires an administrative prompt, changes no policy and does not replace comparison with the policy assigned in Central.
Local check as a Runbook
During a fault, this sequence quickly provides reliable facts:
- Check the local Security Status and time of the last change.
- Check components and versions under About.
- Filter Events and Detections around the time of the fault.
- Trigger an update manually and observe the result.
- Compare Health, Last Active, Agent Mode and effective policies in Central.
- Only then use Self Help or SDU for deeper diagnostics.
The tools for the final step are explained in Diagnose Sophos Endpoint with Self Help and SDU. The symptom-to-component mapping, Windows service changes and the most important log paths are documented in Correctly evaluate Sophos Endpoint Windows logs and services.