Use Sophos Endpoint locally and check protection status
Sophos Central shows the intended central state. The local Sophos Endpoint interface shows what is actually installed on a specific computer, whether components are working and which Events occurred directly on that device. A reliable diagnosis requires both perspectives.
This article covers the local agent on Windows and macOS. Sophos Firewall, Sophos Mobile and Server Protection are separate products.
Open the interface and protection status
On Windows, open Sophos Endpoint from the Sophos icon in the notification area or from the Start menu. On a Mac, use the Sophos icon in the menu bar.
The home page shows security status. Green means there are no alerts or only low-priority alerts, yellow indicates at least one medium-priority alert, red indicates at least one high-priority alert, and gray means the status is unknown. Even a green state does not prove that the device has received the correct Central policy or current software stage. Check these points additionally under My Environment > Computers & Servers.
Check installed functions
About or the product details show installed components and versions. This is particularly important when Central displays an Agent Mode such as Endpoint, XDR or XDR Sensor, but expected modules are missing locally.
On Windows, open the Sophos icon in the notification area and select About at the bottom right. On macOS, use the Sophos icon in the menu bar and select Sophos Endpoint > About. Components may have different version numbers, so record all relevant component versions for a support comparison rather than assuming there is one overall version.
XDR Sensor provides telemetry but does not include full malware protection. A separate protection product must be present and operational in this mode.
Understand local settings
The Settings page shows the protection areas used by the agent. Depending on platform and licence, these include:
- Deep Learning and Real-time Scanning,
- Web, Application and Peripheral Control,
- Runtime Protection and exploit prevention,
- Adaptive Attack Protection,
- local Computer Controls.
Sophos Central normally controls these values. For local troubleshooting, click Admin sign-in on Windows or Admin login on Mac, enter the Tamper Protection password, and enable Override Sophos Central Policy for up to 4 hours to troubleshoot under Settings. Local changes override the Central policy for no more than four hours and then revert automatically. You can end the entire override sooner, but cannot reset individual sliders to the Central value separately.
Operational rule: The override is a time-limited test. Make the lasting correction in the effective policy and then verify it again on the device.
Events and Detections
Under Events, the agent shows local protection and management Events. Filter the list by Event type and time range. This is particularly useful when Central shows only a consolidated Alert or a user reports the exact time of a block.
Detections shows detected suspicious activity and its history. Not every Detection is automatically confirmed malware. Assess the process, path, user, time, Parent Process and possible child activity. More extensive XDR investigations then take place in Threat Analysis Center.
Which actions are available locally
An action link appears only for an event that requires action and only after local administrator sign-in. Sophos describes these as the same actions available in Sophos Central Admin. If the link is absent, first check event state, administrator sign-in, platform, licence and installed component. Local cleanup does not replace incident investigation or a lasting correction of the triggering policy or application.
Central shows events but the local agent does not
If an expected event is missing locally, first reset the event filter to All Events and search by source or detection type. Then compare the time and device with Central. Do not delete local data stores or protected agent files speculatively. If the discrepancy remains, collect an SDU and evaluate the Windows logs with the linked diagnostics guide.
Trigger an update manually
Under About > Update Now, the agent requests current threat data. This can help a temporarily outdated device, but does not bypass a blocked connection, broken proxy or expired licence. Because Sophos uses signatureless detection, the local display alone cannot establish whether the latest product version is installed; the administrator checks that state in Central.
After the update, check three levels separately:
- The local agent no longer reports an update error.
- Components under About show plausible versions.
- Sophos Central updates Last Active, Health and software status.
If only the local display is green while Central still reports an error, check communication, policy assignment and Agent Mode.
Scan a computer or individual file
Under Status or Detections, Scan > Quick scan checks memory, the Master Boot Record, running processes and startup files. Scan > Full scan checks all files and folders as well as memory and the MBR, so it takes longer. A scan started in Central or scheduled by policy is a full scan.
Individual files can be checked in Windows Explorer and macOS Finder with Scan with Sophos Endpoint. On Windows 11, the entry may only appear under Show more options. If it is absent on Mac, enable it under Services > Services Settings or System Settings > Keyboard > Keyboard Shortcuts > Services > Files and Folders.
A scan complements Real-time Protection; it does not replace it. It is useful for a specific suspicion, after Cleanup or when validating a newly installed device. Before a large Full Scan, consider CPU, I/O and working-hours impact.
For automated Windows scans with exit codes and JSON output, see Scan Sophos Endpoint from the CLI.
Clean up a detected threat
When the agent reports a threat, first determine whether it was cleaned up automatically or only detected. Run another scan only after assessment. Recurring Detections, running malware, ransomware or malicious network traffic require isolation and incident triage rather than repeated dismissal.
Do not create an exclusion merely for convenience. The full process is covered in Sophos Endpoint Threat Cleanup and malware removal.
Blocked file transfer
This user-facing feature is available on Windows only. File transfer blocked usually originates from Data Loss Prevention or another control function. During a transfer of several files, the notification may concern a subset while other files transferred successfully.
A toast notification on its own means the policy does not permit user approval. A dialog with Allow and Block, by contrast, allows a decision for that transfer. If no choice is made, it times out after five minutes and no further files are transferred. For multiple files, Sophos transfers files until it reaches the first blocked one. Block ends the transfer and blocks all remaining files; Allow continues until the next match. Files transferred earlier are not recalled.
Record the filename, destination, application, time and user. Then find the corresponding Event in the DLP Event Log and check the effective DLP policy. Broadly allowing the target application would conceal the cause.
Restore access to the computer
After a misconfiguration, Web, network or Peripheral rules can impede access. As long as the device reaches Central, correct the faulty policy first and wait for synchronisation.
If communication is no longer possible, local administrator access and possibly the device-specific Tamper Protection password are required. Physical access may be necessary, particularly when network adapters are blocked. Document the recovery so the same policy is not deployed again.
Capture network traffic directly on the endpoint
For reproducible connection failures such as agent-based ZTNA, open About > Endpoint Self Help as administrator and start Tools > Packet Capture. Temporarily disable Tamper Protection, reproduce only the concrete failure and stop the capture immediately afterwards.
Self Help stores ETL and PCAPNG files under C:\ProgramData\Sophos\Endpoint Self Help\PacketCapture. They may contain internal addresses, DNS names and payload data and must be protected accordingly. Technical limits, UAC requirements and size controls are documented in Diagnose Sophos Endpoint with Self Help and SDU.
Query protection status by CLI
On current Windows endpoints, sophosinterceptxcli.exe is located under C:\Program Files\Sophos\Endpoint Defense. It provides a supported machine-readable state and is preferable to custom registry parsing.
cd "C:\Program Files\Sophos\Endpoint Defense"
sophosinterceptxcli.exe query softwaremonitor all --json
sophosinterceptxcli.exe query configuration on_access_scan_enabled --json
Sophos Software Monitor returns status and, with --json, detailed component and version information. After first installation, the query becomes available only after the first product update, normally after about five minutes. Leave at least one second between queries. Automation must evaluate returned status, exit code and data age rather than assuming every JSON response is healthy.
query configuration returns only effective policy values Sophos exposes, currently including on_access_scan_enabled. It requires an administrative prompt, changes no policy and does not replace comparison with the policy assigned in Central.
Local check as a Runbook
During a fault, this sequence quickly provides reliable facts:
- Check the local Security Status and time of the last change.
- Check components and versions under About.
- Filter Events and Detections around the time of the fault.
- Trigger an update manually and observe the result.
- Compare Health, Last Active, Agent Mode and effective policies in Central.
- Only then use Self Help or SDU for deeper diagnostics.
The tools for the final step are explained in Diagnose Sophos Endpoint with Self Help and SDU. The symptom-to-component mapping, Windows service changes and the most important log paths are documented in Correctly evaluate Sophos Endpoint Windows logs and services.
Official sources
- Sophos Endpoint: Status
- Sophos Endpoint: Settings
- Sophos Endpoint: Events
- Sophos Endpoint: Detections
- Sophos Endpoint: Update now
- Sophos Endpoint: Scan the computer
- Sophos Endpoint: Scan a file
- Sophos Endpoint: Clean up a threat
- Sophos Endpoint: Blocked file transfer
- Sophos Endpoint: Software Monitor
- Sophos Endpoint: Output configuration