Sophos for Marshal

Version: 1.2, Last Revision: October 29, 2026

Sophos for Marshal is a configuration and update tool that allows the Sophos anti-virus scanner to be used with MailMarshal and WebMarshal

These notes are additional to the Help or other documentation.

The information in this document is current as of the date of publication. To check for any later information, please see LevelBlue Knowledge Base article Q21267.

Supported LevelBlue Products

Sophos for Marshal 1.2 is released only in a 64-bit version. This release supports current versions of MailMarshal and WebMarshal.

Hardware and Software Prerequisites

Sophos for Marshal 1.2 requires a supported LevelBlue content scanning product (MailMarshal or WebMarshal) running on a Windows version supported by the scanning product.

The LiveProtection feature requires DNS connectivity (port 53) to a local DNS server that can forward queries to Sophos. The DNS server address will be populated automatically based on server settings. You can override the automatic setting if required.

The updater requires access to the following website: https://sophos.marshal.com (HTTPS is required). For details of required ports and destinations see Knowledge Base article 11906.

Licensing

Sophos for Marshal is licensed and purchased through LevelBlue as a module with the supported content scanning products.

Licensing for Sophos for Marshal is included in all subscriptions to the supported products.
Licensing for Sophos for Marshal is included in the trial installations of the supported products.
Engine and IDE updates are available only if the product license key has a current trial or maintenance/subscription entitlement for Sophos for Marshal.

Installing Sophos for Marshal

To install Sophos for Marshal, run the installer package. Immediately after installation, the Sophos for Marshal updater attempts to retrieve the latest virus scanning Engine and IDE (signature) files.

If you need to configure proxy settings, you should do so immediately and then start an update manually.

To configure settings and start an update, start "Sophos for Marshal Configuration" from the Start menu. For details of the configuration tool, see Help.

Notes:

The package does not include a Sophos Engine or IDE files. The updater must run and complete a download of these components before you can use the scanning functionality.

The updater requires access to the following website: https://sophos.marshal.com (HTTPS is required; this is a change from some older versions). For details of required ports and destinations see Knowledge Base article 11906.

To use Sophos for Marshal with a supported LevelBlue product:

Obtain and install the appropriate key for MailMarshal or WebMarshal.
Install the software on every processing server (including all array nodes if applicable). It is not necessary to install Sophos for Marshal on an Array Manager-only server.
Follow the instructions for adding a scanner in the documentation for the specific product.

Upgrading Sophos for Marshal

To upgrade from an earlier version, run the installer package. Settings, Engine, and IDE files are retained.

If a processing engine service (such as the MailMarshal Engine) is under load, the installer may not be able to stop the service. The installer will notify you.

To complete the upgrade when the installer cannot stop a service:

Manually stop the product engine service(s).
Run the upgrade installation.
Manually start the product engine service(s).

Uninstalling Sophos for Marshal

To uninstall Sophos for Marshal:

Remove the Sophos for Marshal scanner from all MailMarshal and/or WebMarshal scanning rules.
Delete the Sophos for Marshal scanner from the list of scanners in each installed product.
Restart the Engine services for each product. If the server has not been restarted since Sophos for Marshal was installed, you may need to restart the Controller services as well.
Use the Add/Remove Programs control panel to uninstall Sophos for Marshal.

Change History

1.2.0 (October 29, 2026)

SFM-179	The product is rebranded for LevelBlue.
SFM-186	The development framework is updated.
SFM-194	The version of TLS libraries included is updated.
SFM-196	Programming component libraries included in the distribution are updated.
SFM-197	The Sophos programming SDK used is updated.
SFM-200	Archive extraction software included is updated.

1.1.5.1710 (March 15, 2022)

SFM-156	To shorten the time needed for initialization, all scanner threads share a single copy of signature data.
SFM-165	Versions of third party helpers included have been updated.

Note: To review change history for earlier (unsupported) versions, please see the Release Notes for the specific version

Legal Notice

About LevelBlue

LevelBlue reduces risk and builds lasting resilience so organizations can innovate and advance their mission with confidence. As the world’s most analyst-recognized and largest pure-play managed security services provider, LevelBlue elevates client outcomes that matter: stronger defense, faster response, and sustained business continuity. LevelBlue combines AI-powered security operations, advanced threat intelligence, and elite human expertise to provide the most comprehensive portfolio of strategic advisory, managed security, offensive security, and incident response services..