Sophos XDR Server

Investigate and respond to attacks on servers

Sophos XDR Server combines server protection with tools for investigating and responding to threats. Alongside Sophos Endpoint, the server licence includes Extended Detection and Response: your IT team can investigate available events and correlate data from connected security products.

XDR supports your own security team; it does not include a round-the-clock MDR service. Sophos is expanding the solution with Secureworks technology. Features of the new security operations interface depend on your account’s migration status. Deployment requires supported server operating systems, a suitable agent and configured data sources.

Unauthorized File Protection replaces Server Lockdown

Unauthorized File Protection protects Windows servers against execution of program files created or modified without authorisation. It replaces Server Lockdown, whose support ends in October 2026. The existing image shows the former Lockdown configuration.

A monitoring mode helps assess the impact before enabling blocking. Policies for allowed and blocked files control exceptions. Existing Lockdown systems must be unlocked for migration; a blanket one-click block of all software installations does not describe current behaviour.

CryptoGuard

CryptoGuard monitors Windows servers for suspicious encryption activity. On detection, Sophos can stop the process and restore affected files from copies saved by CryptoGuard. Encryption attempts from other devices against accessible shares can also be detected.

This additional protection is particularly relevant to file and application servers. It does not guarantee complete recovery and replaces neither backups nor a tested recovery plan. Available protection features differ on Linux.

Root Cause Analysis

Graphical root cause analysis shows available relationships between a detection, involved processes and files. This helps IT assess a blocked attack and plan next steps.

Its usefulness depends on the recorded data. An incident view therefore does not guarantee that every affected system or attacker action has been captured.

Exploit Protection

Exploit defence detects attack techniques that exploit vulnerabilities in applications and operating system components. Supported Windows servers gain another protection layer alongside malware checks and behavioural analysis.

The mechanisms available depend on platform and agent version. Regular updates and secure server services remain necessary.

XDR adds data queries, Live Response and supported isolation actions for investigations. Availability depends on platform, permissions and enabled data collection. The server licence adds practical tools for your IT team’s root cause analysis.