Sophos Virus Event Activities

In many cases, malware, virus, and adware activities on the network can be detected by an endpoint solution. Understanding the virus threat attack surface on the network will help an analyst determine what threats are attempting to attack systems. SecurityCenter Continuous View (CV), in conjunction with the Log Correlation Engine (LCE), can provide a report for the types of viruses, malware, and/or adware detected by Sophos Endpoint security protection.

Sophos Endpoint security protection detects viruses, spyware, adware, and malicious activities on the network. This report queries the LCE for Sophos events and displays them through 10 charts. The charts included with this report are Virus Event Type Activities, Top 10 Networks with Sophos Virus Events Activities, Sophos Virus Event Activities, Sophos Virus/Spyware and Adware Activities, Sophos Virus/Spyware Event Activities Details, Adware Event Activities Details, Sophos Suspicious Virus Behavior and Miscellaneous Virus Activities, Sophos Suspicious Virus Activities Details, Top 10 Users with Sophos Virus Event Activities , and User Summary with Sophos Virus Event Activities and Trending. The report is available in the SecurityCenter Feed, a comprehensive collection of dashboards, reports, assurance report cards and assets. The report can be easily located in the SecurityCenter Feed under the category Discovery & Detection. The report requirements are:

• SecurityCenter 4.7
• LCE 4.4.0

SecurityCenter Continuous View (CV) provides a centralized solution that allows for the most comprehensive and integrated view of network health. SecurityCenter CV with Log Correlation Engine (LCE) provides continuous network monitoring for Sophos virus event activity on the network. This central point of view provides the security analyst with the ability to continuously monitor Sophos virus activities.

The report contains the following chapters:

• Executive Summary: This chapter displays three charts to provide an executive-level summary on Sophos virus event activities. These charts provide the analyst with evidence of what type of virus threat attack surface is active on the network. The charts are Sophos Virus/Spyware and Adware Activities, Sophos Virus Event Activities, and Top 10 Networks with Sophos Virus Events Activities.
• Sophos Virus, Spyware, and Adware Activities: This chapter provides details of what type Sophos Viruses/Spyware and Adware activities have been detected on the network and what action was taken once detected by Sophos endpoint security protection. This chapter display 1 matrix for the Sophos virus event activity for Virus/Spyware and Adware including what action was taken for the Virus/Spyware or Adware activity. There are 2 detailed tables in this chapter, one for Sophos Virus/Spyware event activates details and for Sophos Adware event activities details. Each table displays the last 100 events respectively for each table including the raw event from the LCE client for these events.
• Sophos Suspicious Behavior and Miscellaneous Activities: This chapter provides details of what type Sophos Viruses/Spyware and Adware activities have been detected on the network and what action was taken once detected by Sophos endpoint security protection. This chapter display 1 matrix for the Sophos virus event activity for Virus/Spyware and Adware including what action was taken for the Virus/Spyware or Adware activity. There are 2 detailed tables in this chapter, one for Sophos Virus/Spyware event activates details and for Sophos Adware event activities details. Each table displays the last 100 events respectively for each table including the raw event from the LCE client for these events.
• Users with Sophos Virus Event Activities: Understanding which users are experiencing virus events allows the analyst to determine the appropriate action needed to address the compromise. This chart allows an analyst to monitor users identified with virus activity.  The counts in the charts and tables display activity that has occurred over the last 7 days. The Top 10 Sophos User Virus Activities Events table displays the top 10 users with the most Sophos virus events over the last 7 days. User Summary with Sophos Virus Event Activities and Trending table displays all users with Sophos virus event activities with trending details table displays the user, count, and trending over the last 7 days.