How to investigate Sophos Firewall Missing Heartbeat Alerts

A Missing Heartbeat Alert does not automatically indicate malware. Sophos Firewall reports it when a previously detected endpoint continues to generate network traffic but no longer sends a matching Security Heartbeat. A faulty Sophos Endpoint can cause this, but the alert can also occur during LAN/Wi-Fi changes, sleep and wake events, because of an unsuitable DNS design or an unexpected network path.

A sound investigation should therefore not start by disabling Security Heartbeat. First determine whether the firewall should monitor the device at all, which traffic triggers the status and whether the endpoint, firewall and Sophos Central all report the same state.

How Missing Heartbeat occurs

Sophos Endpoint sends its status to Sophos Firewall every 15 seconds. If three consecutive heartbeats are missing while the endpoint continues to send network traffic, the firewall changes its status to Missing. As soon as another heartbeat arrives, the endpoint is considered active again.

The firewall associates the device using its MAC address and takes all of the device’s interfaces into account. This is precisely why alerts often occur when switching between Ethernet, a docking station and Wi-Fi: one interface or an old network path may still generate traffic while the heartbeat is already using another path.

Missing is also different from a red or yellow heartbeat:

• Missing: The firewall sees traffic but does not receive a current heartbeat.
• Yellow: The endpoint reports a warning state, such as an outdated signature or a PUA.
• Red: The endpoint reports a critical state, such as active malware that has not been cleaned up.

A Missing status is therefore a communication and association problem unless the investigation proves otherwise.

Check the prerequisites and scope first

Security Heartbeat requires a registered Sophos Firewall, Sophos Central Endpoint Protection and a valid Network Protection subscription. The basic configuration is described in Connect Sophos Firewall to Sophos Central.

Check Missing heartbeat zones

Under System > Sophos Central > Optional configurations, the Missing heartbeat zones field determines the zones in which the firewall detects missing heartbeats. Include only zones where managed Sophos endpoints are expected.

Guest, IoT, printer or server networks without Sophos Endpoint should normally not be included in this scope. In mixed environments using Microsoft Defender or another EDR, devices may be well protected but cannot send a Sophos Security Heartbeat.

The scope must match the firewall policy. Sophos documents a counter-intuitive special case: if a Heartbeat policy blocks a zone that is not listed under Missing heartbeat zones, the Security Heartbeat widget in Control Center may still show Missing. Always check the zone field and the affected firewall rules together.

Verify the licence and Central status

Registration and Security Heartbeat must be active under System > Sophos Central. In Sophos Central, check the following for the affected computer:

• Is the endpoint online and assigned to the correct tenant?
• Does it show a green, yellow or red health status?
• Are there Endpoint Events at the same time?
• Has the device been reinstalled, renamed, duplicated or removed from Central?

If several devices are affected at the same time, the cause is more likely to be the registration, network path or policy. Individual devices that repeatedly trigger alerts are more likely to indicate an endpoint service problem, adapter change or local network configuration issue.

Classify typical causes correctly

LAN, Wi-Fi, sleep and docking stations

The default timer for detecting a missing heartbeat is 60 seconds. During an adapter change, the firewall may still see DNS queries or background connections associated with the old IP address or MAC address. Power-off, suspend, hibernate and wake events can produce a similar pattern.

Windows devices with Modern Standby and Sophos Endpoint Protection Core Agent 2023.2 or later notify the firewall before entering sleep. Modern Standby alone should therefore not cause a Missing Alert on these devices. With older agent versions or other power-saving states, correlating the timing remains important.

DNS traffic during a network change

DNS is often the last visible traffic from a client that is changing networks. Sophos documents this pattern in known issue NC-178843 for SFOS 21.5 GA: external DNS resolvers in particular can trigger additional Missing Alerts during a network change.

A consistent DNS design is advisable for managed clients. If Sophos Firewall is the only DNS forwarder, internal domains must be forwarded to internal resolvers using suitable DNS Request Routes. The procedure is described in Configure DNS Request Routes on Sophos Firewall.

Using internal DNS servers directly is also a valid design. The key is for DHCP, VPN profiles and endpoint configuration to expect the same resolver path. Switching to the firewall as a DNS forwarder is not a general requirement, but a targeted correction when external resolvers have demonstrably caused excessive alerts.

VPN, routers and NAT in the path

Security Heartbeat works reliably only when the endpoint and firewall share the expected path:

• Endpoint traffic must not already be routed through another VPN tunnel before the Heartbeat connection is established.
• For Sophos Connect, the Send Security Heartbeat through tunnel option under Remote access VPN > IPsec > Advanced settings may be required.
• An endpoint behind an intermediate router can produce incorrect results.
• Behind a NAT gateway, endpoints cannot correctly share their individual health status with the firewall.

Packet Capture and a routing check are more informative here than looking at the Central status in isolation.

Check the firewall rule precisely

Heartbeat controls are located under Rules and policies > Firewall rules > [rule] > Configure Synchronized Security Heartbeat. The four settings serve different purposes:

• Minimum source HB permitted: Allows only source endpoints with at least a Green or Yellow status. No restriction also allows devices without a heartbeat or with a red status.
• Block clients with no heartbeat: Blocks source devices without a heartbeat.
• Minimum destination HB permitted: Checks the health status of internal destination devices. This check does not apply to destinations in the WAN zone.
• Block request to destination with no heartbeat: Blocks requests to internal destinations without a heartbeat.

An important special case is easy to overlook: if an endpoint initially sent a heartbeat and later loses it, the firewall handles it according to the configured policy. A device that has never sent a heartbeat remains allowed unless both Block clients with no heartbeat and Block request to destination with no heartbeat are enabled.

Web traffic has another exception. A matching exception under Web > Exceptions can allow web requests despite Block clients with no heartbeat. For ports 80 and 443, check both the firewall and web filter logs. Test a firewall rule with Log Viewer, Policy Test and Packet Capture explains how to combine the Rule ID, Policy Test and Packet Capture.

Heartbeat conditions should apply only to clearly defined Sophos Endpoint groups. Printers, scanners, IoT devices, guests and third-party EDR clients usually require a separate, tightly scoped rule rather than a broad exception in the main rule.

Reduce false alerts in a controlled manner

Sophos provides two supported Device Console timers. Before making any changes, display the current value and document the alert times.

Delay detection on the firewall

In the CLI, select 4. Device Console and check:

system synchronized-security delay-missing-heartbeat-detection show

The permitted range is 30 to 285 seconds in 15-second increments, and the default is 60 seconds. If adapter changes have demonstrably caused false alerts, you can, for example, increase the value to 90 seconds:

system synchronized-security delay-missing-heartbeat-detection set seconds 90

Then repeat the same LAN/Wi-Fi or docking sequence. A higher value reduces brief false alerts but also delays the detection of a genuinely missing heartbeat.

Delay the notification to Sophos Central

If the firewall detects the status correctly but Sophos Central alerts too quickly during sleep, hibernate, shutdown or wake events, check:

system synchronized-security suppress-missing-heartbeat-to-central show

The range is 0 to 120 seconds, and the default is 0. Set a targeted delay of 60 seconds as follows:

system synchronized-security suppress-missing-heartbeat-to-central set seconds 60

This timer does not change the local Heartbeat policy. It only delays when the firewall reports the Missing status to Sophos Central.

Clear stale Missing entries

After completing the root-cause analysis, you can remove old entries from Control Center and reports:

system synchronized-security missing-endpoints delete name endpoint1
system synchronized-security missing-endpoints delete days-missing 7

Deleting an entry only removes the displayed status. It does not repair the endpoint or Heartbeat communication. Do not delete an entry until you have documented the device, time and cause.

Verify the change

A change is complete only after you have reproduced and tested the original sequence:

1. Record the alert time, endpoint name, IP address, MAC address, zone and affected Rule ID.
2. Check the Security Heartbeat status in Control Center and the zone scope under System > Sophos Central.
3. Compare the health status and Endpoint Events in Sophos Central for the same period.
4. In Log Viewer, filter by Rule ID, Source IP and the No Heartbeat status. For web traffic, also check the web filter.
5. If you suspect a path issue, use Diagnostics > Packet capture to check which interface carries the DNS and application traffic.
6. Repeat the actual trigger, such as switching from Ethernet to Wi-Fi, and confirm that the alert and access now behave as expected.

For deeper troubleshooting, Diagnostics > Tools > Troubleshooting logs provides heartbeatd.log for endpoint status and application information and hbtrust.log for communication between the firewall and Sophos Central. Find and interpret Sophos Firewall service logs explains the purpose of further files.

Errors in heartbeatd.log relating to the detection of new applications belong to Synchronized Application Control and do not automatically indicate a Missing Heartbeat problem. Investigate Synchronized Application Control errors safely provides the more suitable procedure.

Operational decision

In an environment consisting solely of Sophos Endpoint devices, using Heartbeat as a strict access requirement can be appropriate. In that case, zones, rule scope, Central monitoring and a runbook for missing heartbeats must be aligned.

In mixed endpoint environments, use Heartbeat selectively. Devices without Sophos Endpoint are not automatically insecure; they simply do not provide a Sophos signal. Clear segmentation and separate rules are more reliable than a global Heartbeat requirement that constantly needs exceptions in day-to-day operation.

Frequently asked questions