Sophos Antivirus

The Sophos Antivirus check runs on the device and monitors the locally installed Sophos protection: core services, real-time protection, signature age, threats or quarantine, and optionally web protection on macOS. It runs on Windows and macOS (each as an x64 and an Arm64 build), every 15 minutes by default; Linux is not supported. No Sophos Central connection is required.

Steps

1. Open the device under Devices and switch to the Checks tab.
2. Click Add Check → Sophos Antivirus.
3. Adjust the settings if needed.
4. Click Add Check.

To roll the check out to many devices at once, add it to a config package — see Assign checks with config packages.

Settings

Advanced options (visible after enabling Show advanced options)

If Signature warning age (hours) is higher than Signature critical age (hours), the check swaps the two values before evaluating. It treats a warning age below 1 as 1.

Results

The check reports the worst status of all problems it finds.

The signature thresholds are compared as "older than": an age exactly on the threshold does not trigger anything yet. If the local query cannot run or exceeds the timeout, the check reports Failure.

What the check inspects per platform

On macOS, the check counts quarantine items with sqlite3. If the tool is missing, it reports 0 items.

FAQ

Why does the check report a stopped core service while real-time protection is active?

On Windows, all three core services must exist and be running:

• Sophos Endpoint Defense Service
• Sophos File Scanner Service
• Sophos MCS Agent

Check them in services.msc. A running Sophos MCS Client does not replace the File Scanner service. Real-time protection is evaluated separately, so it can appear active even when a core service is missing or stopped. Investigate a missing service in the Sophos installation rather than dismissing the alarm because real-time protection is active.

See also: Set up alerts for a check