Sophos Managed Threat Response for Windows Endpoint

Components Updated

For information about the changes to the Sophos Core Agent, see the Sophos Core Agent release notes.

For information about the changes to Sophos Endpoint Advanced, see the Sophos Endpoint Advanced release notes.

For information about the changes to Sophos Intercept X, see the Sophos Intercept X release notes.

For improvements and new features in Sophos Central, see What's new in Sophos Central.

Version 2.0.0

New features

This version adds Response Action Framework (RAF). This includes the following features:

• The MTR team can define custom response actions.
• You can push a file to an endpoint during an investigation.
• You can automate conditional execution of response actions.

Updated components

Sophos MTR Endpoint Agent has been updated to 2.0.0.74.

Version 1.0.3 update

Updated components

Sophos MTR Endpoint Agent has been updated to 1.0.3.11.

Resolved issues

• Fixed a problem with remotely retrieving a file from a managed device to assist an MTR investigation.

Version 1.0.3

New features

• Remotely retrieve a file from a managed device to assist an MTR investigation. The file can be used as case evidence or submitted to Sophos for malware analysis (including static and dynamic malware).
• Added ability to turn on and off verbose logging to improve troubleshooting.
• Minor bug fixes.

Updated components

Sophos MTR Endpoint Agent has been updated to 1.0.3.2.

Version 1.0.2

Updated components

Sophos MTR Endpoint Agent updated to 1.0.2.10.

Version 1.0.1

New features

Sophos Managed Threat Response (MTR) provides 24/7 threat hunting, detection, and response. It is delivered by an expert team as a fully-managed service. Beyond simply notifying you of attacks or suspicious behavior, the Sophos MTR team initiates actions on your behalf to neutralize even the most sophisticated and complex threats. Two levels of service are available:

• MTR Standard: lead-driven threat hunting, adversarial detections, activity reports, security health check.
• MTR Advanced: MTR standard features plus lead-less threat hunting, enhanced telemetry, proactive posture management, dedicated incident response lead, direct call-in support, asset discovery.

Known issues and limitations

System requirements

This version of Sophos Managed Threat Response is supported on Windows 7 and later.

In addition:

• Sophos Intercept X must be installed on the endpoint.
• EDR must be enabled in the Sophos Central Endpoint Threat Protection policy. Under Remediation, ensure that the following settings are turned on:
  • Enable Threat Case creation
  • Allow computers to send data on suspicious files, network events, and admin tool activity to Sophos Central

For a full list of system requirements, see knowledge base article 121027.

Support

You can find technical support for Sophos products in any of these ways:

• Visit Sophos Community at Sophos community and search for other users who are experiencing the same problem.
• Visit Sophos support at Sophos support.
• Find how-to, configuration and troubleshooting videos at Sophos Techvids video hub.

Legal notices

Copyright © 2021 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos and Sophos Anti-Virus are registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.