Sophos Security

Posted on  by admin

Security Heartbeat is a feature that allows endpoints and firewalls to communicate their health status with each other. Find the details on how it works, what different health statuses there are, and what they mean.

See how the threat landscape is changing in our Security Threat Reports. From Sophos, the leader in antivirus, malware removal, encryption and network security.

Communication channel

Endpoints and XG Firewall communicate through an encrypted TLS connection over the IP address 52.5.76.173 on port 8347.

  • Sophos Cloud Security Free Trial Sophos protection for AWS, Azure and Google Cloud Platform secures cloud infrastructure, data, access roles and configurations from the latest threats. Sophos XG Firewall: All-in-one firewall and synchronized communication with.
  • British infosec biz Sophos reckons just under half of malware traffic it saw in the wild during the opening three months of 2021 alone was using Transport Layer Security (TLS) to encrypt both its command-and-control traffic and data exfiltration. The company says that figure is up from 23 per cent of known malware traffic during the whole of 2020.
  • The Sophos XG 115 firewall is one of the best SMB firewalls that offers superior performance with a simple management interface. These XG 115 firewalls are rated for 26-35 users, 4 Gbps firewall throughput, and 490 Mbps VPN throughput.

Identification of endpoints

Each endpoint receives a certificate from Sophos Central. Sophos Central shares those certificates with XG Firewall, so XG Firewall is able to attribute an endpoint to a specific organization. XG Firewall only establishes connections with endpoints for which it possesses their certificate.

Information exchange

  • When an endpoint connects to XG Firewall for the first time, it sends the details of its current health status, network interfaces, and signed-in users.
  • Endpoints send a heartbeat (their health status) to XG Firewall every 15 seconds. These messages are called heartbeat.
  • XG Firewall sends a list of endpoints whose health status is red (at risk) or yellow (warning) every second heartbeat, that is every 30 seconds.

Missing heartbeat

XG Firewall logs a heartbeat as missing when it doesn’t receive three consecutive heartbeats from an endpoint that continues to send network traffic. When the endpoint sends the heartbeat again, XG Firewall considers it active. A missing heartbeat is determined by the MAC address of an endpoint, and all interfaces are taken into account.

To avoid frequent and misleading notifications about endpoints going into a missing heartbeat status after intentional actions (typical scenarios can include power off, suspend, hibernate, or moving to a different network adapter), additional configuration options are available for the detection of missing heartbeat statuses. The default configuration should achieve the desired results in most cases, but should you encounter challenges in the default behavior, you have two options to customize the detection behavior. Using these options may delay the missing heartbeat notifications you want to receive.

  • Increase the default timeout for missing heartbeat detection: The default timeout between the last received security heartbeat messages and moving the endpoint into a missing heartbeat state when still detecting network activity of the endpoint is set to 60 seconds. In some cases, when switching between network adapters, in particular when switching from a wired to a wireless connection, this timeout can be too short.
  • Delay sending Missing Heartbeat state to Sophos Central: By default, XG Firewall directly sends information to Sophos Central about an endpoint going into the missing heartbeat state. This results in Sophos Central sending an email notification about the missing heartbeat state.

To change the default settings for how these events are handled, you can configure the timeout values using the command line interface. For more information see, CLI guide synchronized security settings.

Green heartbeat status

A green heartbeat status requires no action and means that:

  • Sophos security software is working correctly.
  • No active malware is detected.
  • No inactive malware is detected.
  • No potentially unwanted application is detected.

Yellow heartbeat status

Typical reasons for a yellow status are:

  • A newly installed PUA (potentially unwanted application).
  • 24 hours since the last signature update.
  • Inactive malware is detected.
  • A potentially unwanted application is detected.

Usually, it is temporary and no action is required. However, you can choose to take action when a PUA or malware is detected.

Red heartbeat status

A red status requires action. A typical reason is that active malware has been detected and couldn’t be automatically removed.

You should take action if one or more of the following issues occur:

  • Active malware is detected.
  • Running malware is detected.
  • Malicious network traffic is detected. This traffic might lead to a command-and-control server involved in a botnet or other malware attack.
  • Communication sent to a known bad host is detected. This is based on the IP address or DNS resolution.
  • Malware was not removed.
  • Sophos security software is not working correctly.

Source heartbeat and destination heartbeat

Source and destination heartbeats define the minimum required heartbeat from the source and destination, respectively. These can be found under the respective firewall rule.

Protection based on health status (lateral movement protection)

Endpoints communicate with another endpoint based on its health status and the policy specified in Sophos Central. For example, if an endpoint has a red health status and there’s a corresponding policy defined, other endpoints would stop communicating with that endpoint.

Sophos Security

XG Firewall will handle this communication between endpoints. It acts as a MAC layer 2 proxy to tell each endpoint within the same broadcast domain the MAC and health status of all other endpoints.

Tap mode and Security Heartbeat

For Security Heartbeat to work in tap mode you must have at least one interface configured within the LAN Zone that is regularly connected to the network and whose address can be reached from the endpoints. The IP addresses of all interfaces within the LAN zone are transmitted to Sophos Central and further to the endpoints. Endpoints in turn try to connect to one of the LAN zone IP addresses to send their Security Heartbeat messages to.

Sophos Web Security and Control Test Site

This test site contains pages classified by SophosLabs for the purpose of testing our web security and control products. Note that some pages are classified as potentially offensive or dangerous however the page content itself should be considered safe for viewing in all circumstances.

Sophos Sandstorm Test Files

These files enable testing and demos of Sophos Sandstorm on Sophos products enabled with Sandstorm. They are harmless files with active content that will trigger Sophos Sandstorm analysis.
SandStorm Test File 1
SandStorm Test File 2 (email only)

Sophos HIPS Test Files

These files enable testing and demos of Sophos behavior protection (HIPS) feature for endpoint products. The executable is a harmless file that will trigger a behavior-based Sophos detection HPmal/Eicar-A.
Sophos HIPS Test (zip)
Sophos HIPS Test (exe)

Adult or Sexually Explicit

Includes sites for adult products including sex toys, CD-ROMs, and videos; child pornography and pedophilia (including the IWF list); adult services including video-conferencing, escort services, and strip clubs; erotic stories and textual descriptions of sexual acts; explicit cartoons and animation; online groups, including newsgroups and forums that are sexually explicit in nature; sexually-oriented or erotic sites with full or partial nudity; depictions or images of sexual acts, including with animals or inanimate objects used in a sexual manner; sexually exploitive or sexually violent text or graphics; bondage, fetishes, genital piercing; naturist sites that feature nudity; and erotic or fetish photography, which depicts nudity.
Note: We do not include sites regarding sexual health, breast cancer, or sexually transmitted diseases (except those with graphic examples).

Advertisements and Pop-ups

Includes sites of banner ad servers, sites with pop-up advertisements, and sites with known adware.
Note: Sophos's advanced categorization data uses the most current technical definition for Adware, and thus recognizes the difference between non-malicious adware, such as 'cookies' and more serious Spyware.

Alcohol or Tobacco

Includes sites that promote or distribute alcohol or tobacco products for free or for a charge.

Anonymizers

Includes sites that operate proxy services, or offer proxy software, with the specific intent of defeating security and control.

Arts

Includes sites for museums, galleries, artist sites (sculpture, photography, etc.), performing arts (theater, vaudeville, opera, symphonies, etc.), dance companies, studios, and training; book reviews and promotions; and variety magazines and poetry.

Blogs and Forums

Includes sites of weblogs (blogs), newsgroups, and opinion or discussion forums.

Business

Includes general business corporate web sites, international and multi-national large general business corporate sites, business associations, and basic business sites, such as FedEx, that enable organizations to manage their necessary daily business tasks.
Note: Business sites that fit more appropriately into another related category, such as Finance or Travel, will be categorized in those categories.

Call Home

Includes sites identified to be used for command & control servers (callhome, C2) by malware running on infected computers.

Chat

Includes sites of web-based chat and instant message servers.

Computing and Internet

Includes sites of reviews, information, buyer's guides of computers, computer parts and accessories, computer software and internet companies, industry news and magazines, and pay-to-surf sites.

Criminal Activity

Includes sites for advocating, instructing, or giving advice on performing illegal acts; tips on evading law enforcement; and lock-picking and burglary techniques.

Custom

Includes sites categorized for use with a custom policy. For example, you could set sites that you want to be always approved by adding them to your local classifications list, and setting their Risk class to Trusted and their Site category to Custom.

Downloads

Includes sites for downloadable (non-streaming) movie, video or sound clips; downloadable PDA software, including themes and graphics; freeware and shareware sites; personal storage or backup sites; and clip art, fonts and animated .gif pages.
Note: This category does not include update sites such as those for operating systems, anti-virus agents, or other business-critical programs.

Education

Includes sites for educational institutions, including pre-schools, elementary, secondary, and high schools and universities; educational sites at the pre-school, elementary, secondary, and high school and university levels; distance education and trade schools, including online courses; and online teacher resources (lesson plans, etc.).

Eicar

The Standard Anti-Virus Test File.

Entertainment

Includes sites about television, movies, music and video programming guides; online magazines and reviews of the entertainment industry; celebrity fan sites; broadcasting firms and technologies (satellite, cable, etc.); horoscopes; jokes, comics, comic books, comedians, or any site designed to be funny or satirical; online greeting cards; and amusement and theme park sites.

Fashion and Beauty

Includes sites of fashion or glamor magazines, online beauty products, and cosmetics.

Finance and Investment

Includes sites for stock quotes, stock tickers, and fund rates; online stock or equity trading; online banking and bill-pay services; investing advice or contacts for trading securities; money management or investment services or firms; general finances and companies that advise about finances; and accountancy, actuaries, banks, mortgages, and general insurance companies.

Food and Dining

Includes sites for recipes, cooking instruction and tips, food products, and wine advisors; restaurants, cafes, eateries, pubs, and bars; and food and drink magazines and reviews.

Gambling

Includes sites of online gambling or lottery web sites that invite the use of real or virtual money; information or advice for placing wagers, participating in lotteries, gambling, or running numbers; virtual casinos and offshore gambling ventures; sports picks and betting pools; and virtual sports and fantasy leagues that offer large rewards or request significant wagers.
Note: Casino, hotel, and resort sites that do not feature online gambling or provide gaming tips are categorized under Travel.

Games

Includes sites for game playing or downloading, game hosting or contest hosting, tips and advice on games or obtaining cheat codes ('cheatz'), and journals and magazines dedicated to online game playing.

Government

Includes sites for local, state, federal and international government sites, and government services, such as taxation, armed forces, customs bureaus, and emergency services.

Hacking and Computer Crime

Web pages that provide 'how-to' directions, or otherwise enable, fraud, crime, or malicious activity that is computer oriented. Web pages related to computer crime include malicious hacking information or tools that help individuals gain unauthorized access to computers and networks (root kits, kiddy scripts). Also included are other areas of electronic fraud such as dialer scams and illegal manipulation of electronic devices. Illegal software does not fall under this category; see 'Illegal Software'.

Health and Medicine

Includes sites for prescription medicines; medical information and reference about ailments, conditions, and drugs; general health, such as fitness and well-being; medical procedures, including elective and cosmetic surgery; dentistry, optometry, and other medical-related sites; general psychiatry and mental well-being sites; psychology, self-help books, and organizations; promoting self-healing of physical and mental abuses, ailments, and addictions; alternative and complementary therapies, including yoga, chiropractic, and cranio-sacral; and hospital and medical insurance sites.

Hobbies & Recreation

Includes sites for recreational pastimes, such as collecting, gardening, and kit airplanes; outdoor recreational activities, such as hiking, camping, and rock climbing; tips or trends focused on a specific art, craft, or technique; online publications on a specific pastime or recreational activity; online clubs, associations, or forums dedicated to a hobby; traditional games, such as board games and card games, and their enthusiasts; and animal and pet related sites, including breed-specific sites, training, shows, and humane societies sites.

Hosting Sites

Includes web sites that host business and individuals' web pages, for example GeoCities, earthlink.net, and AOL.

Illegal Drugs

Includes sites for recipes, instructions or kits for manufacturing or growing illicit substances for purposes other than industrial usage; glamorizing, encouraging, or instructing on the use of or masking the use of alcohol, tobacco, illegal drugs, or other substances that are illegal to minors; information on 'legal highs', including glue sniffing, misuse of prescription drugs, or abuse of other legal substances; distributing illegal drugs free or for a charge; and displaying, selling, or detailing the use of drug paraphernalia.

Infrastructure

Includes sites for content delivery networks, XML reference schemas, web analytics and statistics services, transaction servers, and corporate image servers.

Intimate Apparel and Swimwear

Includes sites for lingerie, negligee, and other intimate apparel modeling; swimwear modeling; models' fan pages; modeling information and agencies; and fitness models and sports celebrities sites.

Intolerance and Hate

Sophos Security

Includes sites that advocate or incite degradation or attack of specified populations or institutions based on associations such as religion, race, nationality, gender, age, disability, or sexual orientation; sites that promote a political or social agenda that is supremacist in nature and exclusionary of others based on their race, religion, nationality, gender, age, disability, or sexual orientation; holocaust revisionist or denial sites and other revisionist sites that encourage hate; coercion or recruitment for membership in a gang or cult; militancy and extremist sites; and flagrantly insensitive or offensive material, including those with a lack of recognition or respect for opposing opinions and beliefs.
Note: We do not include news, historical, or press incidents that may include the above criteria (except in graphic examples).
For the purposes of this category, a gang is defined as: a group whose primary activities are the commission of felonious criminal acts, which has a common name or identifying sign or symbol, and whose members individually or collectively engage in criminal activity in the name of the group. A cult is defined as: a group whose followers have been deceptively and manipulatively recruited and retained through undue influence such that followers' personalities and behavior are altered; a group in which leadership is all-powerful, ideology is totalistic, and the will of the individual is subordinate to the group; and a group that sets itself outside of society.

Job Search and Career Development

Includes sites of employment agencies, contractors, job listings, career information, career searches, and career-networking groups.

Kid's Sites

Includes child-oriented sites and sites published by children.

Malware

Includes sites identified to be hosting malicious content, representing a significant security concern.

Motor Vehicles

Includes sites for car reviews, vehicle purchasing or sales tips, and parts catalogs; auto trading, photos, and discussion of vehicles including motorcycles, boats, cars, trucks, and RVs; journals and magazines on vehicle modification, repair, and customization; and online automotive enthusiast club sites.

News

Includes online newspapers, headline news sites, newswire services, personalized news services, and weather sites.

Peer-to-Peer

Includes peer-to-peer file sharing clients and peer-to-peer file sharing servers.

Personals and Dating

Includes singles listings, matchmaking and dating services, advice for dating or relationships, and romance tips and suggestions sites.

Philanthropic and Professional Organizations

Includes sites of philanthropic and charity organizations, environmental organizations, professional associations, labor unions, and social organizations.

Phishing or Fraud

Includes sites involved in phishing and telephone scams, service theft advice sites, and plagiarism and cheating sites, including the sale of research papers.

Photo Searches

Includes sites that provide resources for photography, image searches, online photo albums, digital photo exchanges, and image hosting.

Politics

Includes sites for political parties; political debate, canvassing, election information, and results; and conspiracy theory and alternative government view sites that are not hate-based.

Proxies and Translators

Includes sites for remote proxies or anonymous surfing, search engine caches that circumvent filtering, and web-based translation sites that circumvent filtering.

Real Estate

Includes sites for home, apartment, and land listings; rental or relocation services; tips on buying or selling a home; real estate agents; and home improvement sites.

Reference

Includes sites for personal, professional, or educational reference; online dictionaries, maps, and language translation sites; census, almanacs, and library catalogs; and topic-specific search engines.

Religion

Includes sites of churches, synagogues, and other houses of worship; any faith or religious belief sites, including non-traditional religions such as Wicca and witchcraft.

Reputation

Includes files identified by Sophos as having a low or medium reputation.

Ringtones and Mobile Phone Downloads

Includes sites of providers of mobile phone downloads, including ringtones, logos, backgrounds, screensavers, and games.

Search Engines

Includes general search engines, such as Yahoo, AltaVista, and Google.

Sex Education

Includes sites with pictures or text advocating the proper use of contraceptives; sites relating to discussion about the use of the pill, IUDs, and other types of contraceptives; and discussion sites on how to talk to your partner about diseases, pregnancy, and respecting boundaries.
Note: Not included in the category are commercial sites that sell sexual paraphernalia. These sites are typically found in the Adult category.

Shopping

Includes sites for department stores, retail stores, company catalogs, and other sites that allow online consumer shopping, sites for online auctions, online downloadable product warehouses, specialty items for sale, and freebies or merchandise giveaways.

Society and Culture

Includes sites on home life and family-related topics, including weddings, births and funerals; parenting tips and family planning; non-pornographic gay, lesbian, and bisexual issues; foreign cultures and socio-cultural information; and non-explicit tattoo and piercing parlors.

Spam URLs

Includes URLs found in spam, particularly on these topics: computing, finance and stocks, entertainment, games, health and medicine, humor and novelties, personal and dating, products and services, shopping, and travel.

Sports

Includes sites for team or conference web sites; national, international, college, professional scores and schedules; sports-related online magazines or newsletters; and fantasy sports and virtual sports leagues that are free or low-cost.

Sophos Security Vm

Spyware

Includes sites that provide or promote information gathering or tracking that is unknown to, or done without the explicit consent of, the end user or the organization, including sites that carry malicious executables or viruses, third party monitoring, and other unsolicited commercial software, spyware, and malware 'phone home' destinations.
Note: The technical definition of Spyware used for this category may not exactly match the definition used elsewhere by Sophos. This category focuses on filtering malicious and tracking content, not simply adware and cookies. For non-malicious adware filtering, please block the Advertisements and Pop-ups category.

Streaming Media

Includes sites for streaming media files or events (any live or archived audio or video file), Internet TV and radio, non-explicit personal webcam sites, telephony sites that allow users to make calls via the internet, and VoIP services.

Tasteless or Offensive

Includes sites that feature offensive or violent language, including through jokes, comics, or satire, and excessive use of profanity or obscene gesticulation.

Travel

Includes sites of airlines and flight booking agencies, accommodation information, travel package listings, city guides and tourist information, and car rentals.

Violence

Sophos Security Vm

Includes sites portraying, describing or advocating physical assault against humans, animals, or institutions; depicting torture, mutilation, gore, or horrific death; advocating, encouraging, or depicting self-endangerment, or suicide, including through eating disorders or addictions; instructions, recipes, or kits for making bombs or other harmful or destructive devices; sites promoting terrorism; and excessively violent sports or games, including videos and online games.
Note: We do not block news, historical, or press incidents that may include the above criteria, except those that include graphic examples.

Weapons

Includes sites with online purchasing or ordering information, including lists of prices and dealer locations; any page or site predominantly containing, or providing links to, content related to the sale of guns, weapons, ammunition or poisonous substances; displaying or detailing the use of guns, weapons, ammunition or poisonous substances; and clubs which offer training on machine guns, automatics, other assault weapons, and sniper training.
Note: Weapons are defined as something (as a club, knife, or gun) used to injure, defeat, or destroy.

Web-Based Email

Includes sites for web-based e-mail accounts and messaging sites.

Learn more about our web security and control products at our main sophos.com website.