Endpoint Protection
Suggest, discuss, and vote on new ideas for Sophos Endpoint Protection. Comprehensive security for users and data
-
Sophos Central Send Reports to Cloud (Sharepoint\Dropbox\Box\AWS...)
Currently, Event Reports only do 6 months of reports and gets sent via email.
I would love to generate .pfd's of all my reports but our attachment limit via email is 10MBCould you not allow or link a URL to a Sharepoint\Dropbox\Box\AWS cloud storage share?
Sign in verify the user login then collect reports there.2 votes -
Fix the Running malware in quarantine or cleanup failure indicator in Sophos Central
We're constantly having hosts that have a status of red because Sophos is falsely reporting that "Running malware in quarantine or cleanup failure" Can we fix this or have an automated process to delete the events.db?
4 votes -
Block single peripheral, whilst allowing all by default
In Sophos Central, you can block all peripherals by default - and then have an allow list
You can't do it the opposite way round, where you allow all devices and just have a block list.
When trying to create a Peripheral Exemption to Block a device, with the default being Allow, it says that "Exemptions cannot be stricter than global settings."
This mean that for a particular customer, we have to Allow around 300 USB devices just to block a singular device which a user brought in with malicious content on.
It would be good to just block a…
35 votes -
Option to delete files when it can't be cleaned by Sophos
We have several site all around the world but Sophos is centraly managed which means that we cannot always physically go to client computers or remotely connect to them (because of time zone, bad internet connectivity, etc...).
So when an alert for files like those is raised in the console:
Manual malware cleanup required: 'Mal/VMProtBad-A' at 'G:\PortableApps\Sid Meier's Civilization V + DLC\CivilizationV_DX11.exe'
Manual malware cleanup required: 'Mal/Sality-D' at 'E:\hasna .scr'
Manual malware cleanup required: 'Mal/VB-OL' at 'E:\Data Dell.exe'I would like to be able to select "Delete" and not just wait that something happen. Currently the only option is "Marked…
16 votes -
Scan ALL
Scan ALL Computers from Central
7 votes -
lockdown
would be nice to be able to see more lockdown events than 24 hours and also to be able to search/filter by date range. Also, why cant we get email alerts when lockdowns happen?
1 vote -
Changing of license type from Advance to standard in portal
Client mentioned below:
Client advised that they are using command line method to deploy Sophos Antivirus
but they didn't found in below KBA for option for Standard and advanced license product option
and due to that they need to login to each client portal -> go to Licensing -. and then change the license type from Advance to Standard
and he is looking something automatize through command line as in below KBA
https://community.sophos.com/kb/en-us/127045
Advised him, currently there is no option, however he may go as a feature request which go towards the Sophos developing team but unfortunately we don't have…
1 vote -
Console option to view if endpoint needs restart
It would be convenient for admins and end users if we could see in the "Devices" page within the Sophos Central Console a column that shows if the endpoint needs to be restarted (generally for applying updates.) Furthermore have the option to be able to sort by this column.
1 vote -
Export Alerts from the Sophos Central UI
Please provide the ability to export from the Alerts page in the the Sophos Central UI.
1 vote -
Display status of client from taskbar icon
When a PC has the Endpoint Protection Client deployed via Sophos Cloud, if the client has issue or is out of date, there is no visual prompt on the Sophos shield icon in the notification area. You have to open the client and then click about, to see when a client last updated.
When we used to use Sophos Enterprise Console, the Sophos icon in the notification area would have a red cross overlaying the icon, notifying the user of a problem
1 vote -
Prevent loading of Finder Extension in Mac OS
Sophos installs a Finder Extension in Mac OS, which provides icon overlays amongst other things. This kills the icon overlays in Dropbox Smart Sync and makes that product unusable. It would be helpful (essential for many customers) for the Sophos Cloud console to let us choose not to have this extension (or to have it, but for it not to set icon overlays so that Dropbox becomes useful). We have developed a solution but it's quite a pain to deploy on Sierra, or requires MDM on High Sierra, which many customers will not have.
2 votes -
central alerts
Sophos Central Alerts can be overwhelming. I need the ability to clear all alerts without checking on the 5000 alerts individually. I'd like to see just red alerts where Sophos could not clean up the issue. We see red alerts even when the issue has been resolved. So if it had been resolved it could change to a different color to still be able to see that there was an issue, but it doesn't need attention. Working for a school district we need to manage Sophos easily and efficiently due to time constrictions. Thank you!
1 vote -
Root Cause Analysis - Allow save of layout for Visualize tab
Root Cause Analysis allows for a convenient re-arranging of the items in the Visualize tab, but that layout disappears when you navigate off the tab or page. Need an option on the Visualize tab to save the layout.
4 votes -
Root Cause Analysis - Print or save to PDF
Provide a means to print an RCA in a presentable format. Perhaps allow to save/export that report to PDF.
2 votes -
Tamper Protection Report
Currently the only way to tell if Tamper Protection has been disabled for a device is Sophos Central is to view the Summary page of each device. My suggestion is to add a column to the existing "Servers" and "Computers" reports (under Logs & Reports -> Endpoint & Server Protection) that indicates whether or not Tamper Protection is enabled.
26 votes -
Batch update / scan action when selecting multiple machines/servers
Batch update / scan action when selecting multiple machines/servers for Chemung NY
1 vote -
Stop alerting when endpoint not updated in 2 days; Or make this configurable.
We need to be alerted only on important conditions. Being alerted that a laptop has missed two updates (laptops are often off for more than two days) is not helpful and, in fact, may result in the team paying less attention to Sophos alerts. We need to be able to configure this or at minimum, please change the default. Thanks,
63 votes -
API
It was usefull to get all active Customers with ALL active liences via API
1 vote -
Drill down / pivot in event or alert reports
Alerts: Please add ability to click somewhere on the Alert line to drill down or pivot to the details of the alert. In the popup/window, for file related alerts like PUA, please provide the file name and path, hash, and date metadata.
Events: In the reports like Web Stats, thanks for the ability to click from the Summary into a list of events. However, the list is still only a summary for that user/computer. Please allow further drill down/pivot such that when we click on a line/event, it actually shows the sites visited which would aid in categorization correction or…
1 vote -
.msi file installer for Sophos cloud
Good morning,
I was told that Sophos can create a .msi file installer for Sophos Cloud by raising a case here. We need a .msi file to add to our builds in SCCM. Can you please create one for us?
Please see the email below by the advisor.
"Hello Yusuf,
This is regarding case id - 7560289
Unfortunately we don't have .msi files for our installers due to the way they are coded for each customer. If you would like to request that we make MSI installers available for download then please do raise a feature request for this: https://www.sophos.com/en-us/support/feature-requests.aspx
…
12 votes
- Don't see your idea?
