Sophos Analytics¶

Sophos Dashboards¶

Adding the Sophos Dashboards¶

1. Go to Settings >> Knowledge Base from the navigation bar and click Dashboards.

2. Select VENDOR DASHBOARD from the drop-down.

3. Click the Use icon from Actions of the required dashboard.

4. Click Choose Repos.

5. Select the repo configured to store the Sophos logs and click Done.

Selecting a Repo¶

6. Select the dashboard and click Ok.

Selecting Repos¶

You can find the Sophos dashboards under Dashboards.

Sophos Dashboard¶

Sophos Dashboard¶

Sophos Labels¶

Using Sophos Report Templates¶

The available report templates are:

• LP_Sophos UTM Safeguarding: It is the incident summary report that provides statistical information on the searched URLs, search categories and terms, blocked URLs, sources, and users, detected by Sophos UTM in different formats, such as graphs and lists.

• LP_Sophos XG Firewall: It is the incident summary report that provides statistical information on the blocked/malicious emails, blocked malware, outbound/inbound attacks, DoS attacks, allowed/denied destination and source addresses, detected by Sophos XG Firewall in different formats, such as graphs and lists.

Generating Sophos Report Templates¶

1. Go to Report >> Reports Template.

2. Select VENDOR REPORT TEMPLATES from the drop-down.

3. Click the Use Vendor Report from Actions of the required template.

Using Sophos Report Template¶

4. Click the Run This Report from Actions.

Using Sophos Report Template¶

5. Select Repos, Time Zone, Time Range, Export Type and enter Email.

6. Click Submit.

Running Sophos Report Template¶

You can view the reports being generated under Report Jobs and download the generated reports from Inbox with .pdf extension by clicking PDF under the Download section.

Generating a Report¶

Generating a Report¶

You can view the reports being generated under Report Jobs and download them. Click PDF under Download to get .pdf formatted reports.

You can analyze the data using a report’s graphs, time trends, lists, and text. Report data summarizes incidents during a specific period, such as the past 24 hours or the past five minutes. While generating a report, you can customize the calendar period according to your needs. For more information on how to schedule reports, go to Scheduling.

Sophos Alerts¶

LP_Sophos XG Firewall - Detected Malware Infected Mail¶

• Trigger condition: Logpoint detects malware-infected mail related to SMTP, POP3, and IMAP4.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos XG Firewall

• Query:

  norm_id=SophosXGFirewall label=Mail label=Malware label=Infect label=Detect
  

LP_Sophos XG Firewall - Inbound Attack Detected by IDP¶

• Trigger Condition: Logpoint detects the inbound attack defined in the IDP policy.

• ATT&CK Category: Impact

• ATT&CK Tag: Network Denial of Service, Endpoint Denial of Service

• ATT&CK ID: T1498, T1499

• Minimum Log Source Requirement: Sophos XG Firewall

• Query:

  norm_id=SophosXGFirewall label=Attack label=Detect label=IDP destination_address=* -source_address in HOMENET | process geoip(source_address) as country
  

LP_Sophos XG Firewall - Outbound Attack Detected by IDP¶

• Trigger Condition: Logpoint detects the outbound attack defined in the IDP policy.

• ATT&CK Category: Impact

• ATT&CK Tag: Network Denial of Service, Endpoint Denial of Service

• ATT&CK ID: T1498, T1499

• Minimum Log Source Requirement: Sophos XG Firewall

• Query:

  norm_id=SophosXGFirewall label=Attack label=Detect label=IDP destination_address=* -destination_address in HOMENET | process geoip(destination_address) as country
  

LP_Sophos Central - Multiple Instances of Failed Update¶

• Trigger Condition: Logpoint detects multiple instances of update failed on an endpoint.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral label=Fail label=Update destination_host=* |chart count() as hst_cnt by destination_host|search hst_cnt>10

LP_Sophos Central - User Application Blocked¶

• Trigger Condition: An application is blocked for a user.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral group=APPLICATION_CONTROL action=Blocked user=* application=*

LP_Sophos Central - Multiple Host Affected by the Same Threat¶

• Trigger Condition: Multiple hosts (greater than 10) are affected by the same threat.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral file=* destination_host=* threat=* |chart distinct_count(destination_host) as hst_cnt by threat|search hst_cnt>10

LP_Sophos Central - Multiple Host Affected by the Same Threat¶

• Trigger Condition: Multiple hosts (greater than 10) are affected by the same threat.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral file=* destination_host=* threat=* |chart distinct_count(destination_host) as hst_cnt by threat|search hst_cnt>10

LP_Sophos Central - Endpoint Policy Non-Compliant¶

• Trigger Condition: An endpoint is non-compliant with a policy.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral group="POLICY" compliance_status="non-compliance" user=* policy=*

LP_Sophos Central - Real-Time Protection Disabled¶

• Trigger Condition: The real-time endpoint protection is disabled.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral label=AntiVirus label=Disable user=* destination_host=*

LP_Sophos Central - Same Domain Blocked for Multiple User¶

• Trigger Condition: Multiple users visit the same blocked websites.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral group=WEB action=blocked domain=* user=* |chart distinct_count(user) as usr_cnt  by domain|search usr_cnt>10

LP_Sophos Central - Multiple Peripheral Devices Allowed¶

• Trigger Condition: Multiple peripheral devices in the endpoint are allowed.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral label=Alert label=Device object=* user=* |chart distinct_count(object) as dvc_cnt by user|search dvc_cnt>2

LP_Sophos Central - Potential Threat Detected¶

• Trigger Condition: A potential threat is detected in an endpoint.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral group=PUA file=* threat=* destination_host=*

LP_Sophos Central - User Browsing Blocked Sites¶

• Trigger Condition: A website is blocked for a user.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral group=WEB action=blocked domain=*

LP_Sophos XG Firewall - Detected Malware Infected Mail¶

• Trigger Condition: A malware-infected email related to SMTP, POP3, or IMAP4 is detected.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos XG Firewall

• Query:

norm_id=SophosXGFirewall label=Mail label=Malware label=Infect label=Detect

LP_Sophos XG Firewall - Excess Amount of IP Spoof Denied¶

• Trigger Condition: IP spoof is detected and denied.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos XG Firewall

• Query:

norm_id=sophosXGF action="Denied" label="Spoof" | chart count() as spoof_count by destination_address,protocol  | search spoof_count > 10

LP_Sophos Central - Host is Out of Date¶

• Trigger Condition: Logpoint detects an out-of-date host.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos XG Firewall

• Query:

norm_id=SophosCentral label=Device label=Outdate destination_host=* user=*

LP_Sophos Central - Same Application Blocked for Multiple User¶

• Trigger Condition: The same blocked application is used by several users in an organization.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral group=APPLICATION_CONTROL action=blocked application=* user=*|chart distinct_count(user) as usr_cnt by application|search usr_cnt>10

LP_Sophos Central - User Browsing Multiple Blocked Sites¶

• Trigger Condition: Multiple (more than five) blocked websites are visited by a user.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral group=WEB action=blocked domain=* user=* |chart distinct_count(domain) as dmn_cnt  by user|search dmn_cnt>5

LP_Sophos XG Firewall - Spam Mail Detected and Accepted¶

• Trigger Condition: A spam email or a probable spam email concerning SMTP, POP3, or IMAP4 is detected and accepted.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos XG Firewall

• Query:

norm_id=SophosXGFirewall label=Accept label=Detect label=Mail label=Spam -label=Forward | chart distinct_count(log_id) as DC by sender | search DC>5

LP_Sophos Central - User Accessing Multiple Blocked Application¶

• Trigger Condition: A user accesses many blocked applications.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral group=APPLICATION_CONTROL action=blocked application=* user=*|chart distinct_count(application) as app_cnt by user|search app_cnt>2

LP_Sophos Central - Multiple Threat Affected Host¶

• Trigger Condition: Multiple threats (more than two) affecting a host.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Sophos Central

• Query:

norm_id=SophosCentral file=* destination_host=* threat=* |chart distinct_count(threat) as thrt_cnt by destination_host|search thrt_cnt>2