Skip to content

Getting started

Sophos NDR uses a virtual appliance (VA) that detects malicious behavior on your network. This sends data to the Sophos Data Lake so that you can analyze it in Sophos Central's Threat Analysis Center.

To install the Sophos VA, go to Sophos Central and configure and download an Open Virtual Appliance (OVA) file. You then install the OVA file on a VMware ESXi instance. See Sophos NDR.

Currently the VA only runs on VMware ESXi. You must use ESXi 6.7 or later.


You can access the VA with the VMware web console. You can then use the Sophos VA console to manage Sophos NDR.

To find out how to use the Sophos VA console, see Using the console.

To set the correct VM size for your VAs and your network, see Sizing the virtual appliance.

To configure your VA, see Configuration.