Sophos

Sophos Endpoint Protection is a comprehensive endpoint security solution that combines next-generation anti-malware, exploit prevention, ransomware protection, and endpoint detection and response (EDR) capabilities. It uses deep learning AI to detect both known and unknown threats, and features Synchronized Security that shares intelligence between endpoint and network products.

For security response actions, Sophos provides extensive endpoint containment capabilities including host isolation, antivirus scanning, file hash blocking, forensic snapshot collection, and email retraction. The Snapshot Forensic Information capability captures a point-in-time forensic view of a compromised endpoint for investigation. These comprehensive response actions enable security teams to contain threats, collect evidence, and remediate incidents effectively.

Supported Response Actions:

• Isolate Host
• Restore Host (unisolate)
• Initiate Antivirus Scan
• Block File Hash
• Unblock File Hash
• Snapshot Forensic Information
• Retract Email