Sophos Security Heartbeat and Synchronized Security
Security Heartbeat sends the health state of a managed Sophos Endpoint to a registered Sophos Firewall. This alone doesn’t isolate everything: a matching firewall rule or the endpoint feature Reject connections from other devices must apply the network response.
Keep three mechanisms separate:
- Security Heartbeat: health and identity exchange between Sophos Endpoint and Sophos Firewall. The firewall can use it to control source and destination access.
- Synchronized Security: the umbrella term for responses that use Heartbeat information. These include firewall rules and Sophos Fusion-distributed rejection of unsafe devices on the same subnet.
- Active Threat Response (ATR): isolates devices identified by external API users or MDR/XDR analysts through managed Sophos Switches and AP6 access points. It is neither a Heartbeat colour nor endpoint isolation.
Requirements and activation
Sophos specifies three requirements: a Sophos Fusion (formerly Sophos Central) account, a trial or full licence for at least one Sophos Fusion-managed endpoint, and a Network Protection subscription on the firewall. Endpoint and firewall must belong to the same organisation in the correct Sophos Fusion tenant.
Register the firewall in WebAdmin under System > Sophos Central. After successful registration, SFOS automatically enables Security Heartbeat and Synchronized Application Control. However, A new firewall has been successfully registered to Sophos Central under My Products > Firewall Management > Firewalls confirms registration only, not the Heartbeat of a specific endpoint or a rule’s effect. See Connect Sophos Firewall to Sophos Fusion for the complete registration workflow.
Each endpoint receives a certificate from Sophos Fusion. Sophos Fusion shares the certificates with the firewall so it associates only endpoints from its organisation. Endpoint and firewall use an encrypted TLS connection over 52.5.76.173 and TCP 8347; reachability of the IP and port alone doesn’t prove correct tenant or certificate association.
Interpret Heartbeat states correctly
An endpoint sends its state to the firewall every 15 seconds. On first connection, it also sends network interfaces and signed-in users. The colour indicates urgency but doesn’t replace investigation of the specific alert.
| State | Meaning and next step |
|---|---|
| Green | Protection software works; no active or inactive malware and no PUA is reported. Validate the baseline and normal access. |
| Yellow | For example, a PUA, inactive malware, or no signature update for 24 hours. Review the alert; this may be temporary. |
| Red | For example, active or uncleaned malware, malicious network traffic, or faulty protection software. Investigate the alert and device immediately. |
| Missing | The firewall still sees network traffic but hasn’t received three consecutive Heartbeats. Treat this first as a communication or association state, not automatically as malware. |
Yellow is usually temporary and does not, by itself, require remediation to restore a healthy state. Still inspect the alert to understand the cause. If a PUA or malware is detected, you can choose a targeted intervention based on the finding.
A network alert such as communication with a known bad host can therefore cause a red state. Use the specific event and related report to establish whether Sophos Endpoint, Firewall, or another protection component produced the original detection; the colour alone doesn’t prove the detection source.
Choose the network response deliberately
Control access in the firewall rule
Heartbeat controls are on Sophos Firewall under Rules and policies > Firewall rules > [rule] > Configure Synchronized Security Heartbeat. The fields have different purposes:
- Minimum source HB permitted requires at least Green or Yellow for the source. No restriction also allows Red or devices without a Heartbeat.
- Block clients with no heartbeat handles source devices without a Heartbeat.
- Minimum destination HB permitted checks internal destinations; Sophos doesn’t apply destination Heartbeat to destinations in the WAN zone.
- Block request to destination with no heartbeat handles internal destinations without a Heartbeat.
A device that has never sent a Heartbeat remains allowed by default. Sophos states that it is covered only when both Block clients with no heartbeat and Block request to destination with no heartbeat are enabled. A web exception that skips Policy checks can also allow web requests despite Block clients with no heartbeat.
Put Heartbeat conditions in a narrowly scoped pilot rule for genuinely managed Sophos endpoints. Printers, guests, IoT systems, and devices with third-party EDR need their own rule design rather than ever broader exceptions. See Plan Sophos Firewall rules safely for the general design.
Reject lateral connections at the endpoint
In Sophos Fusion, open the Global Settings icon, then Protection and Remediation > Synchronized Security. Under Reject connections from other devices, Allow devices to reject connections from other devices with red health enables the endpoint response. It applies only to devices connected to Sophos Firewall.
For Red or Missing, Sophos informs the other managed devices on the same subnet about the unsafe device. The destination endpoint logs Access request from computer
You can centrally exclude critical servers. Update Caches and Message Relays are excluded from this mechanism by default so updates and communication paths remain available. Every additional exclusion increases the freedom of movement of a red server and therefore needs an owner, rationale, and review date.
Spam and virus sending is a Sophos Email workflow
Scan computers that send spam or viruses on the same Sophos Fusion page requires both Sophos Endpoint and Sophos Email licences. Sophos Email responds when at least five messages classified as spam or containing viruses are sent from a mailbox within ten minutes: it identifies the owner and assigned devices, blocks the mailbox initially for one hour, and starts an on-demand scan on those devices.
Each new trigger after the preceding block expires doubles the duration. After six triggers, the mailbox is blocked permanently and Sophos Support must handle the case. Turning off the Synchronized Security option stops only the endpoint scan, not the mailbox block. Check the Email event, user-to-device association, and endpoint scan separately.
Pilot and acceptance test
- Select one Sophos Fusion-managed test endpoint and a narrowly scoped firewall rule. Document normal access, required remediation destinations, and an independent admin path first.
- In Sophos Fusion, check the computer’s current health and events from the same period. On the firewall, check the relevant counter under Control Center > User & device insights > Security Heartbeat; when all endpoints are green, the detail view doesn’t list individual endpoints.
- Enable logging on the matching rule and run an allowed test flow from the healthy endpoint. Record source IP, destination, Rule ID, and time.
- Use an approved Sophos test case; don’t stop the agent, tamper with protection, or use production malware. Test Sophos Endpoint protection features describes safe methods.
- Compare the Sophos Fusion alert, endpoint event, Heartbeat view, and firewall log for the same time window. Only the explicitly configured response may take effect.
- After cleanup or the end of the test, confirm that the endpoint returns to Green and normal access returns. Only then expand scope.
Troubleshoot by symptom
- Missing instead of Green/Yellow/Red: Check zone, network path, adapter changes, VPN/NAT, timestamps, and Sophos Fusion association first. Follow Troubleshoot Missing Heartbeat alerts for the complete workflow.
- Sophos Fusion and firewall show different states: Compare the same device and time window. Check registration, endpoint online state, certificate/Sophos Fusion communication, and firewall and endpoint events. Don’t “fix” it by deregistering or adding global exclusions.
- Unexpected blocking: Either endpoint message quoted above identifies Reject connections from other devices. A firewall log with Rule ID and a Heartbeat condition identifies the rule. Correct the cause and scope next.
- Delay in a switched network or over LAG: Sophos documents a supported detection delay in Device Console for this case. Record the current value and rollback before any change; don’t set it speculatively.
- Two endpoints use the same dock or USB interface: SFOS 22.0 MR2 Build 546 fixes false Missing Heartbeat reports under
NC-176012. On older SFOS 22 builds, verify the installed release and plan the firmware change, then retest the affected dock or USB scenario instead of only raising a timer. - Cause remains unclear: Preserve the time window, endpoint ID, health/event extract, firewall Rule ID, IP/MAC, and affected interfaces. Use the case-specific collection below; Self Help and SDU explains safe handling.
Prepare an Endpoint Health case for support
Sophos’s Minimum Escalation Requirements for Windows Endpoint and Windows Server separate status, service, threat, device-isolation, and Synchronized Security cases. Supply your own analysis with the files in every case: the first relevant error, its time, the hypothesis tested, and the result.
- Bad red/amber status: Capture the cause and visible status in a screenshot, confirm the same bad status in Sophos Fusion, and determine whether the issue is current or only a legacy remnant. You may use Reset health status as a controlled test. Then verify whether health remains good or returns with the same event, and attach the SDU and analysis.
- Stopped or missing service/process: Record the Services page and its message in Endpoint Self Help, follow the guidance it links to, and inspect the log for that service. Capture a reproducible startup failure with Process Monitor run as Administrator; select Enable Advanced Output under Filter and All events when saving. Then collect an SDU from the same window. Stop the capture after reproduction and protect it because it can contain process, path, and user data.
- Outstanding threat: Find the same threat in the local event list and Sophos Fusion Events page. If it is present there, try the Sophos Fusion resolution first; if it isn’t, test Reset health status in a controlled way. A reset neither cleans a threat nor replaces a recurrence check. Attach the result, SDU, and analysis.
- Device fails to enter isolation: Check whether it is on an isolation exclusions list or excluded by default. Automatic isolation requires an enabled policy and an actual red health state. Check Sophos Fusion communication and, for Reject connections from other devices, the Heartbeat connection state under Endpoint Self Help > Operations.
- Device fails to leave isolation: Health must be good again and Sophos Fusion communication must work; for an excluded device, also inspect the configured exclusion. For both isolation directions, preserve observations, an SDU, and your analysis before changing policy or exclusions.
- Security Heartbeat doesn’t connect: First confirm that Security Heartbeat is enabled on Sophos Firewall. Compare the connection state under Endpoint Self Help > Operations, errors in
Heartbeat.log, and the firewall’sheartbeatd.logfor the same window. Enable DEBUG logging only for the Heartbeat process and the short reproduction, then restore its previous level and collect an SDU. Closure requires Operations to show a connection, no new matching errors, and the expected firewall/endpoint access to work again.
Distinguish Active Threat Response and endpoint isolation
Sophos Fusion ATR under Global Settings > Protection and Remediation > Allow and Block > Network > Active Threat Response applies to Sophos Switches and AP6 access points. External API users or MDR/XDR analysts can isolate identified MAC addresses through these network devices. On AP6, ATR overrides the MAC Filtering Allowed list configured on SSIDs.
This is a different control path from a Heartbeat firewall rule, lateral endpoint rejection, or manual endpoint isolation. To isolate and safely release an individual endpoint during an investigation, follow Isolate an endpoint and inspect it with Live Response. An ATR state in the network view proves neither a red Heartbeat nor an endpoint action.