Sophos advances endpoint detection and response

The new version of Sophos’ EDR provides the industry’s first solution designed for security analysts and IT administrators now with live discover and response capabilities
Security, CYBERSECURITY, Sophos, EDR

Share

Cyber security specialist, Sophos, has unveiled an updated version of its Endpoint Detection and Response (EDR), the first solution designed for both security analysts and IT administrators, available now in Sophos Intercept X Advanced and Intercept X Advanced for Server with EDR. Significant advancements and new capabilities make it faster and easier than ever before for security analysts to identify and neutralise evasive threats, and for IT administrators to proactively maintain secure IT operations to reduce risk.

Sophos also published new research, “An Insider View into the Increasingly Complex Kingminer Botnet,” underscoring the use of servers in carrying out attacks and the importance of threat intelligence in detecting such activity. The opportunistic Kingminer botnet attempts to gain server access by brute-forcing login credentials, and Sophos now finds that it’s using the infamous EternalBlue exploit in an attempt to spread malware among other attack mechanisms. The new version of Sophos EDR offers a custom-built query engine to detect indicators of compromise.

Kingminer shares many of the attributes that advanced ransomware attackers use to gain access, evidence of the need for EDR with the ability to hunt active attacks. As Sophos recently discovered in its State of Ransomware 2020 survey, only 24 per cent of organisations breached in a ransomware incident were able to detect the intrusion and stop it before it was able to encrypt their files. Sophos’ new EDR capabilities help security and IT teams detect threats and breaches that could otherwise take months to uncover.

“Cybercriminals are raising the stakes, stopping at nothing to capitalise on expanded attack surfaces as organisations increasingly move to the cloud and enable remote workforces. Servers and other endpoints are all too insufficiently protected, creating vulnerable entry points that are ripe for attackers to exploit,” said Dan Schiappa, chief product officer, Sophos. “Sophos EDR helps identify these attacks, preventing breaches and shining light on otherwise dark areas. Live querying capabilities only available with Sophos EDR in Intercept X enable organisations to search for past indicators of compromise and determine the current system state. This level of intelligence is critical in understanding changing attacker behaviors and reducing attacker dwell time.”

Sophos EDR now provides powerful visibility across an organisation’s entire estate, enabling security and IT practitioners to quickly answer critical threat hunting and IT security operations questions, and easily respond. New features include:

  • Live Discover: Pinpoint past and present activity with up to 90 days of data retention. Out-of-the-box ready SQL queries allow administrators to answer threat hunting and IT questions, and can be selected from a library of pre-written options and fully customised by users. This flexible query engine provides access to some of the most granular and detailed endpoint activity recordings that are further enhanced with Sophos' deep learning technology
  • Live Response: Remotely respond and access endpoints and servers using a command line interface to perform further investigation and remediate issues; easily reboot devices, install and uninstall software, terminate active processes, run scripts, edit configuration files, run forensic tools, isolate machines, and more

Sophos EDR is powered by Sophos’ deep learning neural network, which is trained on hundreds of millions of samples to look for threat indicators. Security analysts and IT administrators also gain on-demand access to curated threat intelligence from SophosLabs, which tracks, deconstructs and analyses more than 400,000 malware samples every day.

Available now in Sophos Intercept X Advanced with EDR and Intercept X Advanced for Server with EDR at no added cost, Sophos EDR will support Windows, MacOS and Linux. Its new Live Discover and Live Response features are easily managed in the threat analysis center on the cloud-based Sophos Central platform for real-time information sharing with Sophos’ entire portfolio of next-generation cybersecurity solutions via its unique Synchronised Security approach. Combined with Sophos Managed Threat Response (MTR), a fully-managed threat hunting, detection and response service, organisations can boost capabilities with human analysis for a further evolved approach to proactive security protection.

Webinar #2 | Register to attend - Intergenerational signalling consolidation for the 5G era

Join CommsMEA, Deutsche Telekom and NetNumber as they explore opportunities for intergenerational signalling consolidation for the 5G era. The webinar is free but can only be accessed by registering below in advance.

Editor's Choice

Emerson expands analytics platform for industrial enterprise-level wireless infrastructure management
Plantweb Insight platform adds two new Pervasive Sensing applications that manage wireless networks more efficiently with a singular interface to the enterprise
Digitalisation seen as a competitive advantage by Middle East private businesses
Nearly 80 per cent of private business leaders acknowledge that digitalisation can impact business sustainability
Etisalat introduces Multi-Access Edge Computing architecture delivering best-in-class video streaming performance for 5G networks
MEC architecture achieves performance gains of as much as 90% in video streaming, validating how ultra-low-latency applications will be delivered over 4G and 5G networks

Most popular

Don't Miss a Story