I thought I'd post here as there's a better solution to issues with Websocket and Sophos now. I'm using Sophos Cloud but I'm reasonably sure my client is just the standard Endpoint client. The instructions from Sophos support fixed me up and I don't have to disable any parts of the AV.
On a client machine do the following:
I uploaded a little album if that's helpful http://imgur.com/a/fKFXd