About this software
Sophos Central Network Detection and Response monitors internal network traffic to identify suspicious behavior across unmanaged devices, IoT, insider activity, and zero-day command-and-control attempts. Deployments use a log collector appliance—virtual, hardware, or AWS AMI—that forwards data to the Sophos Data Lake and Sophos Central for investigation. As a licensed integration add-on, NDR integrates with Sophos Central, XDR, MDR, and Sophos Firewall to provide investigation tools and automated response coordination.
Purchase
Sophos XDR
In Stock
Delivery: 1 working day
Loading...
€1.17
Free and without obligation
Do you need more information or looking for another license?
Benefits
- Network visibility: Exposes unmanaged, IoT, and rogue devices communicating on the network.
- Behavioral detection: Uses machine learning and multiple detection engines to find anomalous flows.
- Encrypted traffic analysis: Analyzes encrypted sessions for command-and-control and zero-day indicators.
- Centralized investigation: Investigation Console in Sophos Central provides forensic tools and drill-downs.
- Automated response: Can push threat feeds to Sophos Firewall and coordinate automated actions.
Available languages
- English
- Spanish
- French
- German
- & more supported languages
Support information
- Documentation and guides: Setup, administration, and integration guides are available on Sophos Docs.
- Datasheets and briefs: Product datasheet and solution brief can be downloaded from the product page.
- Deployment resources: Hardware specifications, sizing guidance, and AWS deployment instructions are published.
- Product updates and news: Feature announcements and NDR updates are posted on Sophos News.
- Integration examples: Guides show integration with Sophos Central, XDR, MDR, and Firewall workflows.
Frequently asked questions
What is Sophos XDR?
Sophos XDR is an extended detection and response solution that consolidates telemetry from endpoints, servers, cloud workloads, and network sources to detect, investigate, and support response to security threats.
How does Sophos XDR assist with incident investigation?
By correlating cross-source telemetry into timelines, enriching events with contextual data, and surfacing related indicators to help teams identify root causes and scope incidents.
What telemetry sources does Sophos XDR use?
It leverages telemetry from endpoints, servers, cloud workloads, and supported network and security sensors to provide a consolidated view for detection and analysis.
How does Sophos XDR integrate with existing security tools?
Integration options typically include APIs and connectors to ingest alerts and telemetry, enabling correlation with existing logs and workflows for more efficient triage and response.