Prove Sophos is working — first tool + proof field

1. Why “is it working?” is five questions

Operators collapse five failures into one sentence. The laptop never checked in. XDR never uploaded to the Data Lake. The firewall rule never logged. The SD-WAN gateway failed SLA while the link still looked up. The Peripheral Control policy never attached to that computer. Those are five first clicks.

This page is the night-shift desk for proof. The factory taught the SFOS session — Accept is not ESTABLISHED. Here you learn the five tools you actually open, in order, when someone asks you to prove Sophos is working. Central and XGS/SFOS are one estate. They are not one log store.

Hero · five tiles, one ticket

2. Mental model — five proof tools

Memorise five named objects before you click. Each tool is allowed to prove one thing. Over-claiming a field is how you ship a bad change at 02:00.

3. Decision flow — ticket → first tool

Flowchart first. Do not open the policy editor until a diamond says so.

Path · pick the branch before the menu

4. How to choose — first tool + proof field

Print this next to Central and the XGS admin tab. If you cannot recite the proof field, you are not ready to change anything.

5. Runbook Side A → B → C

Side A proves the endpoint is present and which policy it carries. Side B proves the hunt (TAC). Side C proves the XGS path (Log viewer, then SD-WAN / IPsec). On a messy Sev-2, do them in this order until a field lights up.

Side A — Devices + policy assigned (Central)

1. Open the device list, not the policy editor

   Path: My Environment → Computers & Servers. Official: Computers and servers. Older muscle memory still works: My Products → Endpoint → Computers. Filter Device name or search Name / OS / IP / Tag. Quote Health status and Last active.

2. Read protection, not the tray icon

   On the list: Health status Good / Warning / Bad / Unknown. Last active shows a green dot and Online, or a gray dot and the last contact time. Also quote Agent mode (Endpoint / XDR / XDR Sensor) and Tamper protection (On / Off / Not applicable). XDR Sensor is detection-and-response only — official warning: Sophos will not install anti-malware protection on that mode.

3. Open Status if you need overall health

   Click the computer name → Status tab. Official: Computer Status. Windows shows Overall health plus assessments: Communication, Operations, Services, System, Threat, Update. Each is Good / Warning / Bad / Info. Summary-tab health can differ from the list — Sophos documents that gap. Do not “Reset health status” as a close; a reset clears alerts, it does not clean threats.

4. Prove which policy is assigned

   Same computer → Policies tab. Official Set up policies / About Policies: go to Computers, click the name, look in the Policies tab. That is the assignment. The My Products → Endpoint → Policies list only shows what exists and in which order. Base Policy always sits at the bottom and applies if nothing higher matches.

Side B — Threat Analysis Center / Detections

1. Confirm you are allowed to see detections

   Official: you must have Sophos EDR, XDR, or MDR. Devices must upload to the Data Lake (Data Lake uploads). No upload → empty Detections is expected, not “Sophos missed it.”

2. Open Detections, not Cases first

   Path: Threat Analysis Center → Detections. Official: Detections. Set the time range (commonly last 24 hours, or Absolute date range to the ticket UTC). Filter Entity / device name. Optionally Group by Detection ID.

3. Quote Severity, Detection, Entity, Time

   List columns documented: Severity, Type (Threat or Vulnerability), Detection, Time, Entity, Category (Endpoint, Network, Firewall, Email, Cloud, ID provider, Platform), Source, MITRE ATT&CK. Click the row for the slide-out. That name + entity + timestamp is the ticket. Cases group detections later — do not skip the raw detection.

Side C — Log viewer + SD-WAN / VPN (XGS / SFOS)

1. Confirm the session can log

   Two official switches. On the firewall rule: Log firewall traffic. On System services → Log settings: select Firewall (and SD-WAN if that is the ticket) under Local reporting so Log viewer can show it. Web-policy events also need Log firewall traffic on the associated rule. Source: Log settings; Logs.

2. Open Log viewer and pick the module

   Click Log viewer in the upper-right of any SFOS page — it opens a full-screen window. Official: Log viewer. Use the module drop-down (Firewall, SD-WAN, Content filtering, Heartbeat, …). Add filter: field + condition + value. Free text search also works for ports, IPs, usernames, or rules.

3. Quote log_type and fw_rule_id

   Syslog / Log viewer detail fields: log_type, log_component, log_subtype, fw_rule_id, status (Allow / Deny / Allow Session / Deny Session). log_id is a twelve-character code (type + component + subtype + priority + message). Example from official docs: 010101600001 → type 01 Security policy, component 01 Firewall rule, subtype 01 Allowed. Default Drop all is rule ID 0.

4. If the whole site is dead, switch to status — not another rule

   SD-WAN: Routing → SD-WAN routes. Hover the icon under Active. Profile statuses: In use, Available, Unavailable, In use but SLA isn’t met, Available and SLA isn’t met. IPsec: Site-to-site VPN → IPsec. Two different columns — Active (on/off) and Connection (established / not / partial). Central map: My Products → Firewall Management → SD-WAN Connection Groups (green all active, orange at least one inactive, red all inactive).

Device:     My Environment → Computers & Servers
            Health status + Last active + Agent mode
Hunt:       Threat Analysis Center → Detections
            Severity + Detection + Entity + Time
Session:    Log viewer → module Firewall
            log_type + fw_rule_id (+ log_subtype)
Path:       Routing → SD-WAN routes → Active
            or Site-to-site VPN → IPsec → Connection
Policy:     computer → Policies tab
            named policy actually assigned

6. Five tickets as full stories

These five land every quarter. Memorise first tool + proof field. Times and identities below are lab-only.

Journey · one amber hop is the ticket

SED-01 — Prove the device (Computers & Servers)

01:42 · P2. Priya on a hotel network. Phone photo of a green shield. L1 already drafted a new WAN Accept.

First tool: My Environment → Computers & Servers. Search laptop-pune-07 (lab).

If Last active is not Online: quote the last contact time. There is no firewall row to hunt for that laptop. Next check is agent check-in — offline, deleted, expired licence, or never installed — not a new Accept. Official: inactive devices show a gray dot and the last date/time they contacted Central.

If Online: quote Health status. Then you are allowed to open Status, Events, or Log viewer for her user/IP. The tray icon is not Health status.

SED-02 — Prove the hunt (TAC Detections)

02:05 · P2. Helpdesk: “Sophos missed it — nothing popped.” Someone wants Adaptive Attack Protection on the whole OU.

First tool: Threat Analysis Center → Detections. Time range = ticket window. Filter Entity = laptop-pune-07.

Proof field: a High Detection name on that Entity at that Time — or a clean empty list after you confirmed Data Lake upload + EDR/XDR/MDR. Detections are the not-blocked class. If Intercept X already blocked, that is an Event on the device, not a Detection miss.

SED-03 — Prove the session (Log viewer)

02:20 · P2. Outlook Web opens. Attachments fail after last night’s rule ship. L1 wants “another Accept for outlook.office.com.”

First tool: XGS Log viewer → module Firewall (and Content filtering if the web policy is in play). Filter src_ip + last hour. Confirm Log firewall traffic is on that rule.

Proof field: page host log_subtype Allowed on fw_rule_id=12; attachment host Denied on fw_rule_id=27. That ID is the ticket. Change that one rule — or its web policy — then re-read the same two fields. Automatically created rules (MTA, IPsec, hotspot) land at the top and steal match; official: review positions after auto-create.

SED-04 — Prove the site path (SD-WAN / VPN)

02:40 · P1. Pune branch: every desk lost internet after a 02:00 peer change. Firewall Log viewer for that src subnet is empty. L1 wants a Force-allow any-any.

First tool: Routing → SD-WAN routes — hover Active. Or Site-to-site VPN → IPsec — read Connection, not only Active.

Proof field: gateway Unavailable, or In use, but SLA isn’t met (latency / jitter / packet loss), or IPsec Active but Connection not established (or partial — one subnet pair down). Empty Firewall logs match the official Destroy caveat when the WAN just died. Central map: Firewall Management → SD-WAN Connection Groups orange/red is the estate view, not the hop.

SED-05 — Prove the assigned policy (Policies tab)

03:00 · P3. Finance USB “should have been blocked.” Peripheral Control policy PC-Block-USB-Finance exists and is turned on. Someone wants Tamper protection off so they can “push again.”

First tool: Computers & Servers → that computer → Policies tab.

Proof field: Peripheral Control = Base Policy (lab) — the blocking policy never assigned to this device or user. Official: a user policy covers every device that user has; a device policy covers the computer regardless of who signs in; if both could apply, the higher list item wins. Base Policy is always last.

7. Traps + close-the-ticket proof

Proof · named field, then Closed

Sources

• Sophos Central Admin — Computers and servers (Health status, Last active, Agent mode, Tamper protection, Reset health status)
• Sophos Central Admin — Computer Status (Status tab; Overall health; Communication / Operations / Services / System / Threat / Update)
• Sophos Central Admin — Computer Summary (security health icons; Actions; Agent Summary)
• Sophos Central Admin — Set up policies (My Products → Endpoint → Policies; Computers → Policies tab)
• Sophos Central Admin — About Policies (Base Policy; user vs device; list order; Policies tab)
• Sophos Central Admin — Detections (Threat Analysis Center → Detections; columns; EDR/XDR/MDR; not-blocked definition)
• Sophos Central Admin — Threat Analysis Center
• Sophos Firewall — Log viewer (module selector; Add filter; Destroy timing; SSL/TLS timing)
• Sophos Firewall — Log settings (Log firewall traffic; Local reporting; Firewall / SD-WAN log types)
• Sophos Firewall — Logs
• Sophos Firewall — Syslog guide for SFOS 21.5 (log_type, fw_rule_id, status values, log_id composition)
• Sophos Firewall — Syslog information (log_id example 010101600001)
• Sophos Firewall — Firewall rules (Log traffic; Drop all ID 0; auto-created rules at top)
• Sophos Firewall — Managing SD-WAN routes (Active gateway statuses; SLA isn’t met; SD-WAN Log viewer module)
• Sophos Firewall — IPsec connections (Active vs Connection; partial tunnel)
• Sophos Central Admin — Manage an SD-WAN connection group (VPN tunnel status green / orange / red)
• Sophos Central Admin — Threat Protection Policy (device isolation; red health factors)

Related: Blog 1 · Sophos session factory — SYN_SENT after accept