Add tag data as a reason code to Sophos_log output
Platinum customer request: case 5133456
"We’re trying to run a Splunk report on users who were allowed (act=1) to visit a list of sites that all have a particular tag"
Currently the sophos_log doesn't record what tag was used when you see a blocked by tag reason (rsn=1409).
Darren Coleman commented
To clarify; The request is to add tag data to Sophos_log output for both 'allow' and 'block' results