1. Sophos Utm Microsoft Teams
2. Sophos Xg Appliances

Firewall with synchronized security built in. Microsoft Teams. Category: Controlled Applications: Publisher Name. Free business-grade. Sophos XG Firewall is a next-generation firewall in an all-in-one solution. It combines advanced networking, protections such as Intrusion Prevention Systems (IPS) and Web Application Firewall (WAF), plus user and application controls. Sophos XG Firewall and SD-RED devices provide businesses, schools, hospitals and other organizations with multiple solutions for secure remote connectivity. Employees can have access to applications, email and resources on the network from their own home, just as if they were onsite.

Sophos XG Firewall offers among the highest price per protected Mbps of any firewall on the market thanks to the new Xstream packet-processing architecture, DPI engine and TLS 1.3 inspection. Xstream DPI Engine with high-performance deep packet protection in a single streaming engine for stopping all known and unknown threats.

Post summary:

• With the launch of XG Firewall v18, we are also introducing the first Connector for Sophos Managed Threat Response (MTR)
• MTR Connectors aggregate telemetry from multiple sources beyond the endpoint and programmatically serve it to MTR analysts
• The XG Firewall v18 Connector enhances the MTR team’s ability to prevent, detect, and respond to threats across the network and endpoint
• MTR Connectors are available to Advanced tier customers only; all that’s required of customers is to have XG Firewall v18 managed in Central and use XG Central Firewall Reporting

The Sophos MTR success story

For the past several months since its launch, Sophos Managed Threat Response (MTR) has been changing the way organizations of all sizes manage and respond to cyber threats. While other managed detection and response (MDR) services simply send notifications for potential threats or suspicious events – leaving it up to the customer to manage things from there – Sophos MTR arms organizations with an elite, 24/7 team of threat hunters and response experts who take targeted actions on their behalf to neutralize even the most sophisticated threats. The work our MTR Team does includes:

• Proactively hunting for and validating potential threats and incidents
• Using all available information to determine the scope and severity of threats
• Applying the appropriate business context for valid threats
• Providing actionable advice for addressing the root cause of recurring incidents
• Taking actions on customers’ behalf to disrupt, contain, and neutralize threats

With the launch of XG Firewall v18, Sophos MTR becomes an even more powerful managed service with the introduction of MTR Connectors. Now, Sophos MTR Advanced customers who have their XG Firewalls managed in Sophos Central and use Central Firewall Reporting will also benefit from the MTR team’s ability to leverage the actionable intelligence needed to prevent, detect, and respond to threats across the network and endpoint.

What are Connectors and why are they important?

One of the most prevalent challenges security is that siloed and poorly integrated tools make it difficult for security operators to achieve enterprise-wide visibility. Operators are then forced to pivot from console to console to verify threats, which makes threat investigations more complicated and slows down response efforts.

MTR Connectors aggregate telemetry from multiple sources and programmatically serve it to our team of security operators when and how they need it, extending visibility beyond the endpoint to provide a more complete picture of adversary activities. With the introduction of the XG Firewall v18 Connector, MTR Operators now have network telemetry (such as ATP and IPS events) readily available to identify new indicators of compromise (IoC) and Indicators of Attack (IoA) associated with a customer’s environment.

In the coming months, we will be introducing more MTR Connectors that will further strengthen Sophos’ unique Synchronized Security approach, which empowers Sophos’ entire portfolio of next-generation cybersecurity solutions to work together for real-time information sharing and automatic protection.

To take advantage of MTR Connectors, customers must:

• Be an MTR Advanced customer (Connectors are not available through the MTR Standard tier)
• Have XG Firewall v18 managed in Central
• Use XG Central Firewall Reporting

Office 365 requires connectivity to the Internet. The endpoints below should be reachable for customers using Office 365 plans, including Government Community Cloud (GCC).

Office 365 Worldwide (+GCC) | Office 365 operated by 21 Vianet | Office 365 Germany | Office 365 U.S. Government DoD | Office 365 U.S. Government GCC High |

Start with Managing Office 365 endpoints to understand our recommendations for managing network connectivity using this data. Endpoints data is updated as needed at the beginning of each month with new IP Addresses and URLs published 30 days in advance of being active. This allows for customers who do not yet have automated updates to complete their processes before new connectivity is required. Endpoints may also be updated during the month if needed to address support escalations, security incidents, or other immediate operational requirements. The data shown on this page below is all generated from the REST-based web services. If you are using a script or a network device to access this data, you should go to the Web service directly.

Endpoint data below lists requirements for connectivity from a user's machine to Office 365. It does not include network connections from Microsoft into a customer network, sometimes called hybrid or inbound network connections. See Additional endpoints for more information.

The endpoints are grouped into four service areas. The first three service areas can be independently selected for connectivity. The fourth service area is a common dependency (called Microsoft 365 Common and Office) and must always have network connectivity.

Data columns shown are:

• ID: The ID number of the row, also known as an endpoint set. This ID is the same as is returned by the web service for the endpoint set.

• Category: Shows whether the endpoint set is categorized as 'Optimize', 'Allow', or 'Default'. You can read about these categories and guidance for management of them at New Office 365 endpoint categories. This column also lists which endpoint sets are required to have network connectivity. For endpoint sets which are not required to have network connectivity, we provide notes in this field to indicate what functionality would be missing if the endpoint set is blocked. If you are excluding an entire service area, the endpoint sets listed as required do not require connectivity.

• ER: This is Yes if the endpoint set is supported over Azure ExpressRoute with Office 365 route prefixes. The BGP community that includes the route prefixes shown aligns with the service area listed. When ER is No, this means that ExpressRoute is not supported for this endpoint set. However, it should not be assumed that no routes are advertised for an endpoint set where ER is No.

• Addresses: Lists the FQDNs or wildcard domain names and IP Address ranges for the endpoint set. Note that an IP Address range is in CIDR format and may include many individual IP Addresses in the specified network.

• Ports: Lists the TCP or UDP ports that are combined with the Addresses to form the network endpoint. You may notice some duplication in IP Address ranges where there are different ports listed.

Exchange Online

SharePoint Online and OneDrive for Business

Skype for Business Online and Microsoft Teams

Microsoft 365 Common and Office Online

Sophos Utm Microsoft Teams

Note

For recommendations on Yammer IP addresses and URLs, see Using hard-coded IP addresses for Yammer is not recommended on the Yammer blog.

Sophos Xg Appliances

Related Topics