MANUALLY REMOVE SOPHOS ANTIVIRUS MANUAL

In addition to the automation aspect of deleting devices, we also need to do some auditing and perhaps include some scenarios to enforce manual intervention before deletion can be authorized. Using a SOAR platform will allow you to pass each event through a flow process to determine what should happen to the device.īy checking the data you have from your SIEM against live Sophos Central Endpoint API data, you can make a final validation that the device is indeed inactive and can be deleted. We now have several systems identified in the data which could be deleted from Sophos Central. The best method is comparing the OS build of the device in against the data from Sophos Central. In this instance, this device should have a flag set for manual intervention to avoid errors. There could be a situation where the hostname and domain match a system in the inventory where the OS build does not match.

Calculate how many days since device was last seen: (now() Unix epoch – lastSeenAt Unix epoch)/86400.

Convert lastSeenAt field to Unix epoch time using strptime, lastSeenAt format is: “T12:02:01.700Z”.

By only returning those devices inactive above a certain period of time, we are less likely to delete a device which may not need to be deleted from Sophos Central. The purpose of this is to allow a sensible period of inactivity for a system in the disabled OU. To achieve this without deleting valid devices we need to think of likely scenarios of when we do not want to delete a device. Our aim for this process is to remove devices from Sophos Central which are no longer active. What questions require some logic to answer? Once the two data sources are correlated, we need to establish some comparatives before we pass the data to a SOAR tool for processing to ensure there is some logic to handle the events. You may have another method which works in your environment to achieve this correlation. In an ideal world, we would want to have a universally unique identifier (UUID) which ties them together.

The data is correlated using the hostname and domain of the device.

How can we validate the AD and Central data? Together, these will form a solid base to help determine which systems are potential candidates for deletion. Key fields from this data for this process are: The fields will be gathered using the Sophos Central get endpoint API. We can gather an inventory list of devices using the Sophos Central API. We also need to establish the current devices in Sophos Central. Important fields from this data source are: You will need to monitor the latest changes in the Disabled OU or equivalent location dependent on how your organization manages retired devices and rebuild processes. For a quick overview, below is a process diagram we have in place.įirstly, and most importantly, we need a source of truth for devices, and for most organizations this is AD. To answer these questions, I will cover the basic components of our process as a template for you to implement into your own environment and processes. What tools do I have to assist with this process?.What happens if an active machine is deleted automatically?.What data will I need to collect to help determine whether I can delete a device?.The second option still uses the Sophos Central API to gather device information, but with the added benefit of using a Security Information and Event Management (SIEM) and Security Automation and Orchestration (SOAR) tool to make it as automated as possible from end to end.įor the second option we need to answer a few questions: You can create a script which will delete devices using the Sophos Central API.Īt the end of this blog post there are two demo scripts to allow you to gather inactive devices and then delete them. The first is somewhat a manual process using the Sophos Central API to gather device information and manually cross reference those devices against your source of devices. If there are many devices in need of deleting, we do not want to manually delete these through the UI of Sophos Central. This means there is currently no native method to clear old devices from Sophos Central automatically. So why do I need to do this?Ĭurrently the Sophos Central Active Directory (AD) Sync Utility supports synchronizing AD users and user groups, but not devices and device groups. Although, I’m sure for many of us out there, there’s a device that may have slipped through the net and is lying dormant in Sophos Central. Perhaps your tenant is looking spick and span and is a model deployment. Whatever the reason, you may already have a robust process in place for dealing with such devices. This could be due to a multitude of reasons. The number of devices managed in your Sophos Central will increase over time, and, as your estate evolves, some devices may not have a recent last activity date.

Manually remove sophos antivirus