Introducing Sophos XDR and enhanced EDR

May 5, 2021

We are pleased to announce some exciting product updates, including the launch of Sophos XDR (Extended Detection and Response) and significant enhancements to Sophos EDR (Endpoint Detection and Response).

Introducing Sophos XDR

Sophos XDR goes beyond endpoints and servers, pulling in rich Sophos Firewall, Sophos Email, and other data sources.*

This means you get even more detailed insight when performing threat hunting or IT operations tasks: both a broad, big picture view of your organization’s cybersecurity environment along with the ability to deep dive into areas of interest for granular detail. It’s the best of both worlds.

Here are just a few Sophos XDR use cases:

IT Operations	Threat Hunting
Identify unmanaged, guest, and IoT devices	Extend investigations to 30 days without bringing a device back online
Why is the office network connection slow? Which application is causing it?	Use ATP and IPS detections from the firewall to investigate suspect hosts
Look back 30 days for unusual activity on a missing or destroyed device	Compare email header information, SHAs, and other IoCs to identify malicious traffic to a domain

New to Extended Detection and Response (XDR)? We’ve put together a beginner’s guide to get you up to speed. Download your copy.

*Sophos Mobile and Cloud Optix XDR integration coming soon.

Offline Access with the Sophos Data Lake

A key component of both XDR and EDR, the Sophos Data Lake stores critical data from XDR- and EDR-enabled devices, including access to that data even when devices are offline.

For example, you can look back for unusual activity on a device that has been destroyed or taken without authorization. It’s an important part of cybersecurity visibility, giving your organization the ability to see the entire environment and quickly drill down to granular areas of interest.

Data retention periods are 7 days for EDR and 30 days for XDR. That’s in addition to the up-to-90 days of on-disk data stored on devices.

Sophos EDR keeps getting better

This release brings some of the most-requested features to Sophos EDR, making it even easier to ask and answer business-critical IT operations and threat hunting questions.

Scheduled queries
Have critical information waiting for you. You can schedule queries to run overnight so key data is ready for assessment. You’ll have the information you need to quickly perform threat hunting and IT operations tasks.
Enhanced usability
Work even faster with enhancements to workflows and pivoting. You’ll get to key information faster and be able to take actions and respond even more quickly.

To learn more about Sophos XDR and EDR please head over to Sophos.com/XDR and Sophos.com/EDR today.

Sophos XDR and the enhancements to Sophos EDR will be available late May, 2021.