Sophos
Named by 5 kept items in this workspace.
4 items name it under classification.key entities and 1 under tools.
Search every workspace for Sophos. It matches the name as written, so it can find other things that share it.
The items that name it 5
Endpoint security product that detected the SecurityCheck MSI installation in Incident 1
All technologies in this workspace.