Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/esg/endpoint/help/en-us/index.html?contextId=monitor-software

Monitor software

You can check the status of endpoint components and services with Sophos Software Monitor (SSM).

You access SSM via the command-line tool sophosinterceptxcli.exe. This tool is available in the following location: C:/Program Files/Sophos/Endpoint Defense.

You must be an adminstrator to run SSM from sophosinterceptxcli.exe.

Restrictions

  • You can't send requests to SSM until the first product update after endpoint installation. This update usually happens around five minutes after installation.

  • You can't send requests within one second of a previous request.

Commands

Query softwaremonitor

query softwaremonitor [status type] [--json]

By default, this command returns a brief assessment of every status type you included in the query command.

Results of a software monitor query.

If you add the --json parameter, the command returns more detailed information, including component versions, in JSON format.

Status types

Status type Description
all All information that SSM can return.
communication The self-reported connection status of various Sophos components.
running The current status of Sophos processes, services, and drivers, for example, running or stopped.
updating The updating status, including the names and versions of the installed products.
threat The threat status and the number of current threats on the device.
system System information. For example, whether the system meets minimum requirements, and which antivirus or firewall products are installed.

Refresh softwaremonitor

refresh softwaremonitor

This command forces SSM to re-evaluate the status of all the components, services, and processes that it monitors. If we add new status types, the re-evaluation will also include those.