Endpoint Protection
Suggest, discuss, and vote on new ideas for Sophos Endpoint Protection. Comprehensive security for users and data
-
Collect SHA-256 hash, size, created and modified date meta data on auto remediated file
It should be helpful for the product when it automatically remediates (aka removes without trace or ability to restore for many files types!) report back to Sophos Central various key data about the file such as the SHA-256 hash, size, created and modified date back to Sophos Central to use in EDR searches etc.
I have recently been trying to understand a threat that has been cleaned up and wanted to 1) search for it via EDR using the SHA-256 hash and 2) understand if it was a newly dropped file or one that had been sat there a long…
1 vote -
Search based on TLD
Allow searches based on the top-level domain in Threat Search.
1 vote -
web site browsing
Having the ability to enable / capture all user browsing activity when the need arises would be helpful in troubleshooting issues where a web site appears to be blocked but its unclear of the cause along with responding to HR requests to determine if a user is accessing sites that may not be blocked but are considered risky / not meant to be accessed as a normal course of business.
1 vote -
Threat Search Export
Allow for Threat Search results to be exported as excel and/or CSV for use in a pivot table.
1 vote -
Threat Search Objects Filter
Add the ability to filter out based on the device name or allow boolean operations for username and device name.
1 vote -
Threat Search Object Limit
I sometimes have tens of thousands of indicators of attack and compromise to run through the threat search, but I can do only 100 at a time. Increase the object limit to 500 or allow the importing of CSV's.
1 vote -
Able to download quarantined files from central
If there are detection on the endpoints, the file that is moved to the quarantine must be able to download from the central console.
This can be used as part of EDR incident investigation to be able for the administrator to investigate the detected file and we can also submit the file to SophosLabs for them to create IDE.2 votes -
EDR - assign a threat cases to Central administrators.
Super Admin must be able to assign threat cases to Sophos central administrators.
This will help administrators to watch over their assigned threat cases.
2 votes -
EDR
Receiving an email alert when a new item is added into the Threat Analysis Center would be a great benefit.
3 votes -
EDR Threat Search to Cover All Sub-Estates on an Enterprise Dashboard
For now, EDR's feature Threat Search only covers a specific sub-estate (For and Enterprise Dashboard) where a device of reference for a detection is a member of. Manually, the admin has to copy the artefact (SHA or filename) and threat search it to other sub-estates. It will be helpful to cover all sub-estates in the future for threat searches for easier administration and investigation.
1 vote -
Root Cause Analysis for attacks from remote machines
We recently had an incident where there was a Ransomware detection from a remote internal server that was stopped by Intercept X. It turns out that it was a false positive, however investigating to get to that conclusion was a problem as there is only a generic event created in Sophos Central but no Root Cause Analysis. If you look in the Windows event viewer logs for hitmanpro, you can see which files were affected and where the attack originated from, so the information is available but not being used within Sophos Central. When it comes to critical detections like…
3 votes -
Ability to see which business files were affected
In Threat Cases for Endpoint Protection, it currently shows Possible data involved: x number of business files. When clicking on the list of files it populates but does not show all with no option to expand the list. The investigation process could be eased if Sophos showed the names of the "possible data involved" files and their locations, if possible.
3 votes -
Custom Alerting request
We our a large partner servicing many clients. We need the ability to customize what email address alerts are sent to. Additionally, we need the ability to "tune" the level of the alert. Often we find HIGH alerts are false positive. Items like "policy compliance", or "real-time protection disabled" will come in as HIGH and will then self resolve.
We want to be able to control what HIGH tickets are addressed by our NOC staff.
This customization has become very important to us as we scale. Could Alert customization be "fast-tracked" to production?
Respectfully,
Jeff C5 votes -
Solarwinds Log Event Manager Integration
It appears there is a way to export logs and events into Solarwinds LEM for the on-prem version of Sophos Enpoint Protection server but not the cloud hosted version. We would love a way to import logs into Solarwinds for the Cloud version.
8 votes -
Sophos Central: keep logs of removed endpoint/server
We had an issue where a customer, most likely, did not configure Sophos Server Protection correctly. That server got hit by ransomware. When the customer called for assistance the Sophos Server protection was no longer installed on the server and was also removed in his Sophos Central account.
At the moment there is no option to see logs from removed devices in Sophos Central.
In such cases it would be handy to still be able to retrieve logs from removed devices for a period in order to investigate and also have some proof.3 votes
- Don't see your idea?
