Sophos Central: keep logs of removed endpoint/server
We had an issue where a customer, most likely, did not configure Sophos Server Protection correctly. That server got hit by ransomware. When the customer called for assistance the Sophos Server protection was no longer installed on the server and was also removed in his Sophos Central account.
At the moment there is no option to see logs from removed devices in Sophos Central.
In such cases it would be handy to still be able to retrieve logs from removed devices for a period in order to investigate and also have some proof.