Sophos – SophosLabs Intelix

SophosLabs Intelix is the cloud analysis and threat intelligence service behind Sophos zero-day detection, providing classification and deep analysis of files, web pages and IP addresses along with just-in-time verdicts for suspicious objects. Sophos describes it as the one place where all of its detection technologies are applied together, combining machine learning with long-running SophosLabs research. Suspicious files first pass through the antivirus engine, and only those with executable or otherwise risky content are sent for analysis, where dynamic analysis detonates the sample in a monitored Windows environment while static analysis examines attributes such as age, prevalence and signing. Because detonation follows the whole attack chain, verdicts reflect observed behavior rather than just the initial file. Intelix is built into Sophos Firewall, Sophos Email and Intercept X with XDR, so analysts get explainable context inside tools they already use, and the sandbox technology that Sophos once marketed as Sandstorm is now delivered as Zero-day protection. Security teams and developers can also reach it through a web portal that accepts a file or URL for a full report, through APIs sold via AWS Marketplace, or through an OEM Cloud Sandbox SDK for vendors embedding it. Results are cached across customers so repeat files return in under a second, and most fresh analyses finish within about five minutes.