Managed Threat Response – Artificial Intelligence Mixed with Human Expertise
With Sophos Central Intercept X Advanced for servers with XDR and MTR, you can achieve the highest level of security Sophos can currently offer to protect your servers (Windows Server 2008 R2+). In this bundle you get all the features of Intercept X Advanced for Server with XDR and the MTR service introduced in October 2019.
Try Sophos Central for free!
Create a free Sophos Central account now and try all products, including Central Intercept X Advanced for servers with XDR and MTR Standard without obligation for 30 days. If you are convinced of the solution after your test period, you can easily order the licenses from us.
Active threat response by a team of experts – 24/7
With the MTR service, Sophos has done a huge favor for all the people who would have loved to buy Intercept X Advanced for servers running XDR, but simply didn’t have the resources to really get the potential out of XDR. It takes highly skilled and specialized personnel to use XDR to scan the network for potential threats and take the correct steps when an attack occurs.
With Sophos MTR, you no longer need to go out and find trained personnel yourself. Sophos provides you with a team of threat experts who work 24/7 to combat threats.
24/7 circumstantial threat huntingIf something has been detected on your system that could not be fixed automatically and requires human expertise, the MTR team is there for you on a 24/7 basis. An expert then takes a close look at the critical note and uses his experience to decide what needs to be done.
Attack detectionThe MTR team pays special attention to attacks that are executed through legitimate processes, such as PowerShell. Such attacks are very often successful because they are very difficult for monitoring tools to detect. The MTR team uses proprietary analytics to monitor these processes to ensure they are not being misused for malicious purposes.
Security Health CheckThe Security Health Check ensures that your Sophos Central products, such as Intercept X Advanced with XDR, can always operate at maximum performance. To do this, the MTR team looks at your network requirements and makes recommendations for configuration changes.
Activity ReportsYou’ll learn the current state of your systems, what intelligence was gathered during the reporting period, and what threats were averted. Over the period where you use the MTR service, a histogram of these reports is then created. With the help of this data, Sophos creates so-called “scorecards” for you, which you can use to compare yourself to previous periods.
Onboarding process with maximum control and transparency
Regardless of whether you choose the Standard or Advanced variant, you retain control over how autonomously you want the MTR team to operate. This is regulated right at the beginning in the so-called onboarding process. When you purchase the Sophos MTR service, you can choose from three options that determine what response you expect from the MTR team:
At this level, if the Sophos MTR team has detected a threat or attack, it will only inform you about it, but will not act on your behalf independently. However, you will get a detailed report about the cause and detection with actionable steps to fix the threat on your own.
The Sophos MTR team works with your team or even an external consultancy to respond to the appropriate threats.
Here, the MTR team takes care of containment and neutralization actions completely independently and only informs you about the measures taken.
|Intercept X Advanced for Server||Intercept X Advanced for Server with EDR||Intercept X Advanced for servers with XDR¹||Intercept X Advanced for servers with MTR Standard||Intercept X Advanced for servers with MTR Advanced|
|Web Control/Category-based URL Blocking||✔||✔||✔||✔||✔|
|Application Whitelisting (Server Lockdown)||✔||✔||✔||✔||✔|
|"Deep Learning" malware detection||✔||✔||✔||✔||✔|
|Anti-malware file scans||✔||✔||✔||✔||✔|
|Behavioral analysis before execution (HIPS)||✔||✔||✔||✔||✔|
|Blocking pot. unwanted applications (PUAs)||✔||✔||✔||✔||✔|
|Intrusion Prevention System||✔||✔||✔||✔||✔|
|Data Loss Prevention||✔||✔||✔||✔||✔|
|Runtime behavior analysis (HIPS)||✔||✔||✔||✔||✔|
|Antimalware Scan Interface (AMSI)||✔||✔||✔||✔||✔|
|Malicious Traffic Detection (MTD)||✔||✔||✔||✔||✔|
|Exploit Prevention (details on page 5)||✔||✔||✔||✔||✔|
|Active Adversary Mitigations (details on page 5)||✔||✔||✔||✔||✔|
|Ransomware File Protection (CryptoGuard)||✔||✔||✔||✔||✔|
|Disk and Boot Record Protection (WipeGuard)||✔||✔||✔||✔||✔|
|Man-in-the-Browser Protection (Safe Browsing)||✔||✔||✔||✔||✔|
|Enhanced Application Lockdown||✔||✔||✔||✔||✔|
|Live Discover (cross-environment SQL queries to the Threat Hunting and for security compliance).||-||✔||✔||✔||✔|
|SQL query library (pre-formulated, customizable queries)||-||✔||✔||✔||✔|
|Suspicious event detection and prioritization||-||✔||✔||✔||✔|
|Data storage on hard disk (up to 90 days) with fast data access||-||✔||✔||✔||✔|
|Cross-product data sources (e.g. firewall, e-mail)||-||-||✔||-||see PDF|
|Cross-product queries||-||-||✔||-||see PDF|
|Sophos Data Lake (cloud data storage)||-||7 days||30 days||see PDF||see PDF|
|Threat cases (root cause analysis)||✔||✔||✔||✔||✔|
|Deep Learning Malware Analysis||-||✔||✔||✔||✔|
|Advanced threat data from SophosLabs on demand||-||✔||✔||✔||✔|
|Export of forensic data||-||✔||✔||✔||✔|
|Automated malware removal||✔||✔||✔||✔||✔|
|Synchronized Security Heartbeat||✔||✔||✔||✔||✔|
|Remote terminal access (remote analysis and response)||-||✔||✔||✔||✔|
|On-demand server isolation||-||✔||✔||✔||✔|
|With one click "Remove and block||-||✔||✔||✔||✔|
|Cloud Workload Protection (Amazon Web Services, Microsoft Azure, Google Cloud Platform)||✔||✔||✔||✔||✔|
|Synchronized Application Control (Transparency via applications)||✔||✔||✔||✔||✔|
|Managing your security status in the Cloud (Monitor and protect cloud hosts, serverless functions, S3 buckets etc.)||✔||✔||✔||✔||✔|
|Server-specific policy management||✔||✔||✔||✔||✔|
|Update cache and message relay||✔||✔||✔||✔||✔|
|Automatic scan exceptions||✔||✔||✔||✔||✔|
|File Integrity Monitoring||✔||✔||✔||✔||✔|
|24/7 evidence-based threat hunting||-||-||-||✔||✔|
|Security Health Checks||-||-||-||✔||✔|
|Threat elimination and cleanup||-||-||-||✔||✔|
|24/7 circumstantial threat hunting||-||-||-||-||✔|
|Proactive Security Posture Improvement||-||-||-||-||✔|
|Direct telephone support||-|