Endpoint Protection
Suggest, discuss, and vote on new ideas for Sophos Endpoint Protection. Comprehensive security for users and data
-
a
this is testing
2 votes -
the system tray icon also flags Sophos with an alert icon for better visibility to the user to also pass along to IT there is an issue .
Modify the system tray icon so it flags Sophos with an alert icon when the system has issues that can be seen by users as a flag to notify IT there is a problem with the Sophos installation on that system
5 votes -
wildcard exclusions for exploit mitigation
The idea is to use wildcards or folder base exclusion to prevent subprocesses from Hitman monitoring. For example if "make" starts many of gcc tasks or any other part of the toolchain. It would be nice to exclude the hole toolchain.
6 votes -
Global Exclusions listed in SNTPService.log and Policy.xml
Hello,
When troubleshooting one of our endpoints I checked SNTPService.log and found out, that all global exclusions configured in Sophos Central appear in this log file.
Log location:
C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\sntpservice.logAdditionally to the log file, these exclusions are also listed in the following config XML file:
C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\policy.xmlTo read these log and config files, no admin permissions are needed!
So, if a client got compromised, an attacker just has to check these files to find out which locations on the file system are not monitored by endpoint security and might shelter e.g. malware without triggering…5 votes -
Include Serial numbers in our reports
Add the Serial Number field to the device report and exported list. Usually the serial number is the only common denominator when running an audit.
Right now my audit process is quite time consuming because I can't pull a device report with serial number.
The Computer Report is quite useless without the serial numbers.
It's kind of ridiculous that I can't create a custom report and pull the fields I require.
4 votes -
About Endpoint/Server's Central Server status
There is a information about Sophos Central dashboard page status.
https://centralstatus.sophos.com/It is better to show Sophos Server/Endpoint's product server's status page like Central Dashboard does.
Is it possible to add or create a page like this?So that customer can identify if their endpoint/server page has problem or not.
4 votes -
ARM Processor Support
With the advent of the Surface Pro X, there is becoming a push for more 2-in-1 devices to work on ARM technology (as is found in most cell phones and tablets) to run full Windows OS's. However, there is no support for Endpoint Protection (Cloud or On-Prem) for these types of devices. I would like to see an Endpoint Protection package (Anti-virus, firewall, application control, etc.) that will support ARM processors.
300 votes -
Allow Peripherial Reporting to be sorted by Date
In the reporting section
https://cloud.sophos.com/manage/reports/protection/peripherals/create/blocked
Can the Date column be sortable (ascending/descending)
Whilst it is possible to export to CSV and sort manually, this takes focus away from the product pane of glass and doesn't aid function
If possible, it would be nice to be able to also "drill into" a blocked device and allow from this pane also.
2 votes -
Implement passive forced Client-restart
We noticed that Sophos Endpoint Protection lacks the function of automatic monitoring of the restart status of clients, combined with a configurable automatic forced restart request on the user's client. The only way as a company to trigger this through Sophos Endpoint is actually via Live Response (Beta), but not automatically and by active monitoring beforehand.
The problem we are observing is that serious security gaps arise in companies because employees do not regularly restart clients and thus the rollout of security updates is delayed (e.g. Windows updates). By implementing a monitoring of the restart status of clients, this circumstance…
7 votes -
Bulk Inactive computer removal
We really need the ability to remove computers in bulk. Every time we recompose virtual machines it creates a new computer object and leaves behind a duplicate computer name.
2 votes -
Email notification for red alert device isolation
Please add the option for an email notification when an endpoint auto isolates itself due to a red alert. We currently do not know there is an issue until the user calls us to report that they don't have network access. We should be notified immediately when this happens.
1 vote -
environmental variable for OneDrive
The Endpoint Exclusions do not allow entering the new %OneDrive% EnvVar. The only option is to use %userprofile%<OneDrive - <Business>
In itself it's Okay but it would be better to use the direct variable so that you don't have to type the entire Business name for OneDrive Business.1 vote -
Including Windows OS version in Endpoint protection dashboard
Including Windows OS version in Endpoint protection dashboard rather than just showing "Windows 10 Pro". This feature is available with MacOS, we can see the "version" such as 11.2 or 11.3 rather than just showing "MacOS big sur".
1 vote -
How can I see which version is installed in Sophos Central
How can I see which version is installed in Sophos Central
3 votes -
Searchable List When adding exemptions
When adding Peripheral Exemptions based on Detected peripherals, there should be a searchable option for either the last user or the specific computer that it was detected.
It becomes unmanageable to trace a specific detected peripheral over time.3 votes -
Adding Column for Employee id in the event report
I would suggest a new column or rule in the event report by adding employee id.
This can avoid duplication instead of searching by name or Hostname
1 vote -
Delegate access to quarantine
It would be great if a user who access to a shared mailbox like info@... could access to the quarantine of this mailbox from his own sophos login.
1 vote -
Tamper Protection Report
It would be very beneficial to be able to run a report on all devices that have tamper protection on/off.
2 votes -
DLP Database File Type - Add MS SQL backup file (bak) to the category
Add MS SQL database backup file with the following extension (bak) to the database file type category. Currently, this bak extension is not blocked.
1 vote -
Sophos for ESXI 7
Will ESXI 7.0 be supported in the near future and if not what would you recommend we do with Sophos for a virtual environment running VMware ESXI 7.0? I submitted a ticket and spoke to an engineer who suggested I post my question here.
1 vote
- Don't see your idea?
