Hi KH,

If a real-time event stream is not an option, the solution to address use cases like this where you are using stateful tests (thing X happens after thing Y in Z amount of time) is to use our Historical Correlation feature. This is available in the Actions menu of Log Activity and Network Activity for use in Events or Flows. Essentially you define a saved search which targets the events of interest which you are receiving in batch (so your Sophos Central events in this case) and link it to a set of rules (or all rules if you wish, but in this case you probably want to pick just the relevant stateful ones that aren't functioning properly) and then using your historical correlation profile you can replay those events through the select rules as if they were received in realtime. If you select "Device Time" in the "Correlate Events By" dropdown, this means the historical correlation processor will examine the Log Source Time property of all events returned by the saved search and pass the events through the rules in the order they actually occurred, with appropriate delays to simulate the time at which they actually happened, relative to one another. Note that rules used in historical correlation will only generate offenses, they can't take other actions/responses.

You can choose to schedule your profile to run regularly so you don't have to kick it off manually periodically.
You may also want to create a Routing Rule with action "Bypass Correlation" that matches your Sophos Central events such that you don't get false positives rule hits on those events from the realtime correlation engine - this ensures that they only get processed by the historical correlation processor.

Hope this helps.

Cheers
Colin

Hi KH,

If a real-time event stream is not an option, the solution to address use cases like this where you are using stateful tests (thing X happens after thing Y in Z amount of time) is to use our Historical Correlation feature. This is available in the Actions menu of Log Activity and Network Activity for use in Events or Flows. Essentially you define a saved search which targets the events of interest which you are receiving in batch (so your Sophos Central events in this case) and link it to a set of rules (or all rules if you wish, but in this case you probably want to pick just the relevant stateful ones that aren't functioning properly) and then using your historical correlation profile you can replay those events through the select rules as if they were received in realtime. If you select "Device Time" in the "Correlate Events By" dropdown, this means the historical correlation processor will examine the Log Source Time property of all events returned by the saved search and pass the events through the rules in the order they actually occurred, with appropriate delays to simulate the time at which they actually happened, relative to one another. Note that rules used in historical correlation will only generate offenses, they can't take other actions/responses.

You can choose to schedule your profile to run regularly so you don't have to kick it off manually periodically.
You may also want to create a Routing Rule with action "Bypass Correlation" that matches your Sophos Central events such that you don't get false positives rule hits on those events from the realtime correlation engine - this ensures that they only get processed by the historical correlation processor.

Hope this helps.

Cheers
Colin

Hi KH,

If a real-time event stream is not an option, the solution to address use cases like this where you are using stateful tests (thing X happens after thing Y in Z amount of time) is to use our Historical Correlation feature. This is available in the Actions menu of Log Activity and Network Activity for use in Events or Flows. Essentially you define a saved search which targets the events of interest which you are receiving in batch (so your Sophos Central events in this case) and link it to a set of rules (or all rules if you wish, but in this case you probably want to pick just the relevant stateful ones that aren't functioning properly) and then using your historical correlation profile you can replay those events through the select rules as if they were received in realtime. If you select "Device Time" in the "Correlate Events By" dropdown, this means the historical correlation processor will examine the Log Source Time property of all events returned by the saved search and pass the events through the rules in the order they actually occurred, with appropriate delays to simulate the time at which they actually happened, relative to one another. Note that rules used in historical correlation will only generate offenses, they can't take other actions/responses.

You can choose to schedule your profile to run regularly so you don't have to kick it off manually periodically.
You may also want to create a Routing Rule with action "Bypass Correlation" that matches your Sophos Central events such that you don't get false positives rule hits on those events from the realtime correlation engine - this ensures that they only get processed by the historical correlation processor.

Hope this helps.

Cheers
Colin