MDR threat feeds

Sophos Managed Detection and Response (MDR) service is integrated with the firewall. MDR threat feeds enable Sophos MDR analysts to push real-time threat feeds based on network traffic related to malicious servers.

The firewall automatically blocks traffic based on the IPv4 addresses, domains, and URLs listed in the MDR threat feeds. The action doesn't need you to configure other rules and policies for the threat feeds.

The following diagram shows how Sophos MDR works with the firewall.

Video

The following video gives an overview of MDR threat feeds.

Requirements

1. Ensure you have the following licenses:

   1. Sophos Firewall: Xstream Protection Bundle.
   2. Sophos Central: Sophos MDR Essentials or Sophos MDR Complete license.
   3. Endpoint Protection: Sophos Intercept X if you want Synchronized Security.

2. Go to the Sophos Central page in the firewall and register the firewall with Sophos Central.

3. Configure Sophos MDR.

   MDR analysts take action based on the Threat response mode you select in Sophos Central. See Set up the Sophos MDR service.

4. If you want Synchronized Security, do as follows in Sophos Central:

   1. To configure Endpoint Protection, see Getting started.
   2. To implement lateral movement protection, see Reject network connections.

Configure MDR threat feeds

You can turn on MDR threat feeds and configure logs and exclusions in the firewall.

1. Turn on MDR threat feeds for MDR analysts to push the threat feeds to the firewall in real time.

2. Select the action from the following options:

   • Log only: Only logs the threats.
   • Log and drop: Logs and blocks threats.

3. Click Apply.

More resources

• Add threat exclusions
• Log settings for Active threat response