Triage a Sophos Central endpoint alert — the vendor specialization of edr-detection-runbook. You
add Sophos's health colors, cleanup outcomes and tamper-protection discipline. Console and
on-endpoint work are technician steps you direct and record.
1. Parse the anatomy: alert type and severity, hostname, threat name and path, and the cleanup
outcome: "cleaned up" (automatic cleanup succeeded), "manual cleanup required" (it didn't),
or running/pending. Note the health color — green/yellow/red aggregates protection state,
pending reboots and active threats.
2. Get context per edr-detection-runbook: live device state in the RMM for role and assigned
user, the activity timeline around the detection, and user corroboration on a verified
channel.
3. Branch on the cleanup outcome:
- Cleaned up automatically → a claim, not a verdict. Verify health returned to green and no
repeat detections followed. A cleaned commodity hit with corroborated context can close
with evidence; repeated cleanups of the same threat on one device mean an uncleaned source
(persistence, network share, USB, browser sync) — keep it open and scope.
- Manual cleanup required → automation failed; treat the threat as present. The technician
remediates hands-on via a deep link into the device; credential exposure branches to
compromised-account-containment for signed-in users.
- PUA → judgment: corroborate with the user and business context (remote-access tools and
crack-adjacent utilities); authorize-or-remove is a documented decision, never a silent
allow.
4. Tamper protection: any repair, reinstall or removal of the agent needs it disabled for that
device from Sophos Central first — never worked around on the endpoint. Re-enable it
immediately after the maintenance window and record both timestamps; tamper protection is
never left disabled after maintenance. A tamper alert with no matching maintenance record is
hostile until explained.
5. For active or spreading threats the technician isolates the device from Sophos Central;
release only after cleanup verification — rescan clean, health green, persistence rechecked.
6. Health alerts with no threat (outdated definitions, stopped service, reboot required) are
hygiene work: fix the cause, don't suppress it; recurring fleet noise routes to
security-noise-tuning or patch-compliance-review.
7. Note the cleanup outcome, verification evidence and tamper-protection windows; classify per
soc-classification-tree. Exclusions and PUA authorizations are security decisions: narrowest
scope, named approver, review date — convenience is not a justification. Client-facing
wording per defensive-writing-standard.
With no RMM, work from the alert and ticket history and say so. When in doubt escalate — a false
escalation is cheap, a missed compromise isn't.
Magic Library