Endpoint Protection
Suggest, discuss, and vote on new ideas for Sophos Endpoint Protection. Comprehensive security for users and data
-
Invincea Sandboxing
Hi guys, when Invincea was bought by Sophos I was excited about Invincea's sandboxing feature to be included to Sophos Endpoint Protection.
This however doesn't appear to have been planned.
Useful scenarios include:
- Running unknown/suspicious applications in a sandboxed environment.
- Opening email attachments
- Opening downloaded files
- Manual use by security admins (Specify programs to run in sandbox, or temporarily whitelist a blocked program/file forcing it to run in sandbox for investigations.)That last one is particularly useful, as we've recently had a case where some emails were flagged by Sophos and quarantined. Sophos would block us…
1 vote -
Invincea Sandboxing
Hi guys, when Invincea was bought by Sophos I was excited about Invincea's sandboxing feature to be included to Sophos Endpoint Protection.
This however doesn't appear to have been planned.
Useful scenarios include:
- Running unknown/suspicious applications in a sandboxed environment.
- Opening email attachments
- Opening downloaded files
- Manual use by security admins (Specify programs to run in sandbox, or temporarily whitelist a blocked program/file forcing it to run in sandbox for investigations.)That last one is particularly useful, as we've recently had a case where some emails were flagged by Sophos and quarantined. Sophos would block us…
1 vote -
Custom hashes
In the cases of new/developing incidents, and/or adding IOCs from external threat sharing platforms, it would be incredibly useful for administrators to be able to add custom hashes and have Sophos detect/quarantine them as malicious.
12 votes -
option to block access to newly registered domains
In the UTM it would be nice if we had the ability to have a policy that would block access to domains registered within the previous month, once a site had been around for over a month it would be 'allowed'
4 votes -
Create 'tag' in the IDE's that shows what they are trying to detect.
We have 'sav-update' installed on our mail relays so they automatically download the latest detection IDE's.
It would be a good feature to know that the latest IDE is supposed to detect X-trojan, X-virus or X-worm.
We had an example where one of our customers asked if we now detected the Troj/Agent-ARJS Trojan and I had to reply 'I think so' rather than a definite 'yes'. If I could search the IDE's with the Unix 'strings' command looking for say Troj/Agent-ARJS and found a hit then that would be brilliant.
It should be a simple case of just putting a…2 votes
- Don't see your idea?
