Sophos Device Encryption Suspended Verbose Logging
When updating your windows machines multiple alerts are fired informing admins Device encryption has been suspended. The thought here is to put more verbose logging so these aren't generic alerts but rather actionable alerts. Informing admins if the suspension is due to patching would be helpful as this is a standard practice that occurs every 30 days or so. This would help increase the priority to review this alert if we are able to distinguish between a patching suspension or another process which should be looked into more seriously.