Sophos + D3 Morpheus
Powerful Endpoint and Network Orchestration
Integrations with Sophos make Morpheus the perfect command center for intaking events, scanning for malicious files, and orchestrating actions across endpoints and firewalls. Morpheus’s automation-powered playbooks, MITRE ATT&CK framework, and deep investigative capabilities bring effective and repeatable workflows to all endpoint events.
Expert-Built and Maintained Integrations
D3’s integration team takes the burden of coding, troubleshooting, and updating integrations off your hands. Our deep research into integrated technologies has produced important integrations with three Sophos tools:
- Sophos Central: Ingest alerts into Morpheus from Sophos’ unified management console.
- Sophos Intercept X: Orchestrate security tasks through Sophos’ endpoint protection platform.
- Sophos XG Firewall: Block malicious IPs and URLs on your network.
Use CAse
Compromised Endpoint Remediation
When a compromised endpoint is detected, Morpheus enriches the alert with threat intelligence to get a risk score. If the file is determined to be malicious, Morpheus can then query other endpoints via Sophos Intercept X to find any other instances of the file. Having now identified the full extent of the compromise, the analyst can use Morpheus to orchestrate actions across the affected endpoints, such as to remove the file, block the hash, kill processes, or quarantine the endpoint.
- Triage endpoint alerts through Morpheus’s Event Pipeline
- Automate response across the entire environment
- Scan endpoints for traces of threats
Use Case
Potential Phishing Incident Analysis
With Morpheus’s integration with Sophos tools, when a phishing attempt is reported to the SOC, it triggers an automated phishing playbook in Morpheus that parses out the elements of the email, including the potentially malicious attached file. The file is then checked against integrated intelligence sources and past incidents. If it is confirmed as a genuine incident, Morpheus blocks the IP and URL using Sophos XG Firewall and scans endpoints, via Sophos Intercept X, to find other affected machines.
- Automatically update network and firewall rules based on the results of the investigation
- Detonate suspicious files in an integrated sandbox
- Group events from a phishing campaign into a single incident for investigation
Why Morpheus?
Joint users of Sophos Central, Intercept X, XG Firewall, and D3 Morpheus don’t just get automated endpoint security and incident response, they also get the countless other features that make Morpheus the leading independent autonomous SOC solution, including:
Expert-built codeless integrations across the stack
Tier 1–3 automation, based on deep research into the capabilities of common tools
The Hyperpipe, which reduces alert volume by up to 98%
Cross-dimension correlation, which acts across tools, timeframes, TTPs, and artifacts
Sophos Integrations: Summary
Integrations Done the Right Way
An unlimited number of pre-built integrations, expertly maintained by the largest technical team in security automation. Thoroughly researched, tested and built—and delivered for free. Always.
