Endpoint Protection
Suggest, discuss, and vote on new ideas for Sophos Endpoint Protection. Comprehensive security for users and data
-
Able to download quarantined files from central
If there are detection on the endpoints, the file that is moved to the quarantine must be able to download from the central console.
This can be used as part of EDR incident investigation to be able for the administrator to investigate the detected file and we can also submit the file to SophosLabs for them to create IDE.2 votes -
EDR - assign a threat cases to Central administrators.
Super Admin must be able to assign threat cases to Sophos central administrators.
This will help administrators to watch over their assigned threat cases.
1 vote -
EDR
Receiving an email alert when a new item is added into the Threat Analysis Center would be a great benefit.
2 votes -
EDR Threat Search to Cover All Sub-Estates on an Enterprise Dashboard
For now, EDR's feature Threat Search only covers a specific sub-estate (For and Enterprise Dashboard) where a device of reference for a detection is a member of. Manually, the admin has to copy the artefact (SHA or filename) and threat search it to other sub-estates. It will be helpful to cover all sub-estates in the future for threat searches for easier administration and investigation.
1 vote -
Root Cause Analysis for attacks from remote machines
We recently had an incident where there was a Ransomware detection from a remote internal server that was stopped by Intercept X. It turns out that it was a false positive, however investigating to get to that conclusion was a problem as there is only a generic event created in Sophos Central but no Root Cause Analysis. If you look in the Windows event viewer logs for hitmanpro, you can see which files were affected and where the attack originated from, so the information is available but not being used within Sophos Central. When it comes to critical detections like…
3 votes -
Ability to see which business files were affected
In Threat Cases for Endpoint Protection, it currently shows Possible data involved: x number of business files. When clicking on the list of files it populates but does not show all with no option to expand the list. The investigation process could be eased if Sophos showed the names of the "possible data involved" files and their locations, if possible.
3 votes -
Custom Alerting request
We our a large partner servicing many clients. We need the ability to customize what email address alerts are sent to. Additionally, we need the ability to "tune" the level of the alert. Often we find HIGH alerts are false positive. Items like "policy compliance", or "real-time protection disabled" will come in as HIGH and will then self resolve.
We want to be able to control what HIGH tickets are addressed by our NOC staff.
This customization has become very important to us as we scale. Could Alert customization be "fast-tracked" to production?
Respectfully,
Jeff C5 votes -
Solarwinds Log Event Manager Integration
It appears there is a way to export logs and events into Solarwinds LEM for the on-prem version of Sophos Enpoint Protection server but not the cloud hosted version. We would love a way to import logs into Solarwinds for the Cloud version.
8 votes -
Sophos Central: keep logs of removed endpoint/server
We had an issue where a customer, most likely, did not configure Sophos Server Protection correctly. That server got hit by ransomware. When the customer called for assistance the Sophos Server protection was no longer installed on the server and was also removed in his Sophos Central account.
At the moment there is no option to see logs from removed devices in Sophos Central.
In such cases it would be handy to still be able to retrieve logs from removed devices for a period in order to investigate and also have some proof.3 votes
- Don't see your idea?
