Sophos XDR User

Sophos XDR User combines workstation protection with Extended Detection and Response. It includes Sophos Endpoint and helps your IT team investigate suspicious activity, contextualise events across security products and respond to threats.

Beyond a protection-only licence, it addresses the questions behind an alert: what happened, which devices are affected and what action makes sense now? This requires the agent and intended data sources to be configured. The user licence is separate from the server licence.

Tools for your own security team

Your IT team can investigate and take action using data queries, Live Response and supported isolation actions. XDR brings together information otherwise spread across different security tools.

The product does not replace analysts. It suits teams that want to assess and handle detections themselves. If Sophos should handle this work around the clock, Sophos MDR is the corresponding managed service.

Put suspicious activity into clearer context

Detections and prioritisation help focus attention on relevant activity. Connected firewall, email, identity and other supported security sources provide additional context. Third-party integrations are included in the XDR subscription; the source product and required permissions must be available.

Sophos is expanding XDR with Secureworks technology and a new security operations interface. The interface and features available to an existing account depend on its migration status. Retention claims must therefore account for the data store in use.

Investigate files and attack paths

File and process information and graphical root cause analysis help explain a detection. Together with threat intelligence, they help assess whether a file is malicious and which other systems should be checked.

CryptoGuard and the other endpoint capabilities remain the protection foundation. XDR adds investigation and response; it guarantees neither full forensic analysis of every attack nor recovery of all data. The now-included Email Monitoring System adds email threat visibility, but monitoring does not replace blocking email protection.

The information materials explain the capabilities; older videos may show product names and interfaces that differ from the current version.