Active Threat Response
Active Threat Response (ATR) provides API-triggered responses to automatically isolate malicious hosts across the network. It extends threat intelligence from Sophos MDR, Sophos XDR, Sophos NDR, and third-party solutions to the access layer, helping prevent lateral movement from wired, wireless, managed, and unmanaged hosts. Sophos Switches registered with Sophos Central and covered by a valid support and services license can use ATR.
The ATR APIs are available in Sophos Central. The ATR API ingests threat feed data, allowing MDR analysts and network administrators to quickly isolate malicious hosts across the network.