https://cybertoolchain.io/tools/sophos-protection-for-linux New releases and features in Sophos Protection for Linux, tracked by The Cyber Toolchain. en Sat, 31 Oct 2026 07:43:38 GMT https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html Sat, 31 Oct 2026 07:43:38 GMT Sophos Protection for Linux adds kernel 7.3 support and Helm options to exclude processes and paths from sensor events⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exclude selected processes from process, connection, and DNS events by configuring a new Helm option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exclude selected paths from file events by configuring a new Helm option. • Sophos Protection for Linux now supports kernel 7.3. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html Thu, 15 Oct 2026 07:42:02 GMT Sophos Protection for Linux 5.21.0 adds kernel 7.2 support, Kubernetes Secret MCS token injection, and container metadata in XDR process events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Helm charts now support passing the MCS token using a Kubernetes Secret.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • XDR process events include container information and metadata where available. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Wed, 16 Sep 2026 07:34:12 GMT Sophos Protection for Linux 2026.2 adds kernel 6.19/7.0 support and expands account-activity telemetry to the data lake.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Expands `account_activity_linux` data lake events to include account creation, deletion, and modifications to group membership.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Improves event processing performance for endpoints with heavy container activity. • Introduces data-lake batching updates to increase alert fidelity. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Wed, 16 Sep 2026 07:34:12 GMT SPL 2026.3 adds tamper resiliency, a diagnostic CLI tool, DNS/SNI data lake events, and Update Cache/Message Relay support for Linux servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an `Endpoint Self Help` command-line tool for administrators to view product health and collect diagnostic information from a Linux server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables Linux servers with SPL Agent to be configured as Update Caches and Message Relays in Sophos Central. • Adds automatic detection and recovery for unauthorized changes to SPL Agent files (Tamper Resiliency). • Adds DNS activity and Server Name Indication (SNI) hostname events to the Sophos Data Lake for expanded network visibility. • Adds container information to supported detection events in the Sophos Data Lake. • Adds support for kernel 7.1. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html Mon, 17 Aug 2026 09:02:24 GMT Helm chart 1.0.4 adds environment variable configuration and alert/event output control for Sophos Linux Sensor. • Helm chart `1.0.4` adds configuration of alert and event outputs, allowing operators to control where detections are routed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Mon, 17 Aug 2026 09:02:24 GMT Sophos Protection for Linux 2023.1 adds on-access file scanning and automatic malware quarantine for the Linux agent. • Adds on-access file scanning for the Sophos Linux Agent, configurable via server threat protection policies in Sophos Central (off by default). • Introduces malware quarantine for the Sophos Linux Agent, covering both on-access and on-demand scanning, automatically isolating files on signature match. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Mon, 17 Aug 2026 09:02:24 GMT Sophos Protection for Linux 2023.4 adds ARM64 server support and flexible installer options including custom install paths and pre-install checks. • Supports installing the SPL Agent on ARM64-based Linux servers, enabling Linux Runtime Detections on ARM64 hardware. • Adds installer option to designate a custom install location for the SPL Agent. • Adds installer option to run pre-installation checks without installing the SPL Agent, enabling environment verification and troubleshooting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Mon, 17 Aug 2026 09:02:24 GMT Sophos Protection for Linux 2024.1 adds device isolation, runtime detection health status, and allow-list-by-path for applications. • Adds allow-list-by-path support for Linux, letting users permit applications by filename or path — configurable from event details or at `General Settings > Allowed Applications`. • Adds Device Isolation for Linux: isolate a Linux endpoint from the network via Sophos Central while retaining management connectivity, using existing isolate/remove-from-isolation/exclusion controls. • Includes the Sophos Linux Runtime Detections service in the Security Health view in Sophos Central, updating the health state reported for Linux devices. Breaking changes: • Adding the Sophos Linux Runtime Detections service to Security Health may change the reported security health state for Linux devices in Sophos Central after upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html Tue, 11 Aug 2026 15:34:56 GMT Sophos Linux Sensor 5.18.2 adds DNS query event export to Taegis data lake and SNI details in connection events. • Adds `dns_query_events` event type to the Taegis data lake hydration pipeline, enabled via Helm charts configuration. • Adds SNI (Server Name Indication) details to connection events in the data lake. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html Tue, 11 Aug 2026 15:34:56 GMT Sophos Protection for Linux 5.19.0 adds kernel 7.1 support. • Adds support for kernel 7.1, extending the range of Linux environments where the sensor can run. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Fri, 01 May 2026 00:00:00 GMT Sophos Protection for Linux 2026.2 adds kernel 6.19/7.0 support and account activity monitoring. • Added support for Linux kernels 6.19 and 7.0 • New `account_activity_linux` event type detecting account creation, deletion, and group membership modifications Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Wed, 01 Oct 2025 00:00:00 GMT Sophos Protection for Linux 2025.2 adds Linux Forensic SDU support and Linux Update Management policy configuration. • `Linux Forensic SDU support` enables Incident Response teams to quickly gather information from the endpoint during an investigation. • `Update Management policy` now includes Linux support for configuring content updates. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Sat, 01 Mar 2025 00:00:00 GMT Sophos Protection for Linux 2025.1 adds configurable event journal disk size and improves runtime detection resiliency • Adds the ability to configure event journal disk size for Linux devices directly in Sophos Central Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Fri, 01 Nov 2024 00:00:00 GMT Sophos Protection for Linux 2024.3 adds on-access threat process termination, PrivateTmp detection, and installer host name override. • Adds capability to terminate processes associated with an on-access threat detection • Adds additional detection capabilities when accessing files in PrivateTmp • Adds ability to override the device name for a host during installation via the thin installer Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html Fri, 01 Nov 2024 00:00:00 GMT Sophos Linux Sensor 5.9.3 adds Audit_user_msg table for user event activity and configurable optional_metadata_gathering_timeout • Adds `Audit_user_msg` investigation table to include user event activity on the host and events running in a container • Adds configurable `optional_metadata_gathering_timeout` value to help when encountering slow start-up times for the sensor Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Sat, 01 Jun 2024 00:00:00 GMT Sophos Protection for Linux 2024.2 improves Data Lake event hydration and adds enrichment data to queries. • Reduces the latency between the SPL Agent recording an event on a Linux device and its arrival in the Data Lake Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Thu, 01 Feb 2024 00:00:00 GMT Sophos Protection for Linux 2024.1 adds device isolation and allow list by path configuration via Sophos Central. • Adds network device isolation capability for Linux endpoints, managed through Sophos Central without losing agent manageability • Includes the Sophos Linux Runtime Detections service in Security Health Status reports within Sophos Central • Enables allow list configuration by application filename or absolute path via General Settings > Allowed Applications or event details in Sophos Central Breaking changes: • The addition of Runtime Detections to Security Health may change the security health state displayed for Linux devices in Sophos Central Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Wed, 31 Jan 2024 00:00:00 GMT Sophos Protection for Linux 2023.3 adds Enterprise Software Management, configurable Message Relay/Update Cache at install, and on-read/on-write scan modes. • Supports configuring a Message Relay and Update Cache during installation. • Adds `on-read` or `on-write` scanning modes to the on-access file scanner. • Introduces Enterprise Software Management support, replacing Controlled Updates, giving customers staged rollout control across their estate. Breaking changes: • Controlled Updates for Linux servers will be turned off on January 31st, 2024; customers must migrate to Enterprise Software Management before that date. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Wed, 01 Nov 2023 00:00:00 GMT Sophos Protection for Linux 2023.4 adds ARM64 support and custom install location configuration. • Adds `ARM64` platform support for installing the SPL Agent on ARM64-based Linux servers • Adds `custom install location` designation in the installer for the SPL Agent • Adds options to run pre-installation checks without installing the SPL Agent Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html Tue, 01 Aug 2023 00:00:00 GMT Sophos Linux Sensor 5.5.2 adds Sophos Central as a new destination for detection output • Adds Sophos Central as a new destination in the alert output configuration to send detections directly from the sensor Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Thu, 01 Jun 2023 00:00:00 GMT Adds automatic PUA detection for on-demand and on-access scans • Adds automatic detection of Potentially Unwanted Applications (PUAs) for Linux during on-demand or on-access scanning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Sun, 01 Jan 2023 00:00:00 GMT Sophos Protection for Linux 2023.1 adds on-access file scanning and malware quarantine capabilities. • Introduces Malware Quarantine for suspicious files based on signature matches during on-access and on-demand scanning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_sensor_rn.html Fri, 01 Jul 2022 00:00:00 GMT Sophos Protection for Linux 5.0.2 adds ARM64 platform support. • Adds `ARM64` architecture support to Sophos Linux Sensor. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Wed, 01 Jun 2022 00:00:00 GMT Adds support for Amazon Linux 2022, Ubuntu 22.04 LTS, Oracle 8, Miracle Linux, Debian 10 and 11 to Sophos Protection for Linux. • Adds platform support for Ubuntu 22.04 (LTS) • Adds platform support for Oracle 8 • Adds platform support for Miracle Linux • Adds platform support for Debian 10 • Adds platform support for Debian 11 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html https://docs.sophos.com/releasenotes/output/en-us/esg/linux_protection_rn.html Mon, 01 Nov 2021 00:00:00 GMT Sophos Protection for Linux 1.1.8 adds Event Journals to record AV detections for Live Discover and Sophos XDR • Adds `Sophos Linux Event Journaler` version 1.0.0 to record AV detections. • Adds `Sophos Linux Runtime Detection Plugin` version 4.9.0. • Updates `Sophos Linux Live Response` to version 1.5.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-protection-for-linux