There is a desperate need in the world for sole proprietors and small business owners to get and use these great products. Non of the documentation is at the level where a massage therapist, lawyer, etc. can make any sense of it.
These people may be small now but if you can grow with them you have an untapped market.
I've been doing cyber compliance and have written info sec policies and done training for decades. I'm familiar with the nomenclature and basic concepts but even I can't seem to get this firewall installed. I can help with this with a little help from you.

We would like to have the option to set the user inactivity per login method. We are trying to create a Zone that can only be accessed when the user authenticates with the Sophos Client Authentication Agent. We don't use STAS because we don't want the user to be logged in continiously. It it possible to set the Inactivity time for NTLM logins. Please enable the feature to also specifiy this time for users that are authenticated trough CAA.

When setting the General Maximum session timeout, all users are being disconnected an the duration can not be any longer than the specified option.

Can automatic NAT hairpining be built into SFOS automatically like it is in UTM? Very frustrating to have to create hairpin rules in order to access published servers from behind the same XG firewall. The best solution I've found to date is to set the source zone as "any" on the business rule governing the DNAT for the published service, however, that masks the true source IP address for any device on the outside accessing that published service because the firewall translates the source to it's own IP address. That makes it impossible to filter and restrict access to some published services let alone view access in reports.

JCry ransomware is designed to encrypt data and append filenames with a ".jcry" extension. Once data is encrypted, JCry opens a pop-up window and generates the HTML file, "JCRY_Note.html", then drops a copy in every existing folder. The HTML file delivers a message informing victims about the encryption and ransom demand. This activity was observed in the Information Technology Sector.

*******************************IOC*****************************
Analysis:

Host
IPv4: 172.81.182[.]63
Sighted: 2019-03-08 [only single sightings used]
Kill chain Phase: Command and Control
Characterization: IP Watchlist

Host
URL: http://185.163.47[.]134/flashplayer_install.exe
Sighted: 2019-03-08 [only single sightings used]
Kill chain Phase: Delivery
Characterization: URL Watchlist
[MD5:C86C75804435EFC380D7FC436E344898].

Host
URL: http://76.74.177[.]236/flashplayer_install.exe
Sighted: 2019-03-08 [only single sightings used]
Kill chain Phase: Delivery
Characterization: URL Watchlist
MD5: C86C75804435EFC380D7FC436E344898].

Host
FQDN: kpx5wgcda7ezqjty[.]onion
Sighted: 2019-03-08 [only single sightings used]
Kill chain Phase: Actions on Objectives
Characterization: Domain Watchlist

Host
FQDN: weserenawilliams[.]online
Sighted: 2019-03-08 [only single sightings used]
Kill chain Phase: Command and Control
Characterization: Domain Watchlist

File
Filename: flashplayer_install.exe
Size: 1782579
MD5: C86C75804435EFC380D7FC436E344898
SHA1: 9AAB879DB9AA96683FEB1BE7F741AFAF7099C665
SHA256: D7E118A3753A132FBEDD262FDF4809A76CE121F758EB6C829D9C5DE1FFAB5A3B
SSDEEP: 49152:GIgXEThdDy39yKPSvXfatTt4opKw28qPtH7zPjuO3NF:GIsQ1KavXit3pn2VzPjuy
Sighted: 2019-03-08 [only single sightings used]
Kill chain Phase: Installation
Characterization: File Hash Watchlist

File
Filename: dec.exe
MD5: 6B4ED5D3FDFEFA2A14635C177EA2C30D
SHA1: 50B8940981D51CEA6BAC3A6849F7DF3008A43ACE
SHA256: F2F4323DF1A065CDE9269B1C801FA912B296E36D08452E038778BA16B05DCBA9
Sighted: 2019-03-08 [only single sightings used]
Kill chain Phase: Installation
Characterization: File Hash Watchlist

File
Filename: enc.exe
MD5: 5B640BE895C03F0D7F4E8AB7A1D82947
SHA1: 3F2B30D3E72DF24632FDF505A194E3027723240F
SHA256: 22488ABDDBD4A61BB32BB7C2883B56E2F97541F85125F8D4C1593F65853A1D48
Sighted: 2019-03-08 [only single sightings used]
Kill chain Phase: Installation
Characterization: File Hash Watchlist

File
Filename: msg.vbs
MD5: EAE8D08312FBBB511EFFA07E71EBF73E
SHA1: F55B9028098BBA49FA87DFA7412B52869CFDFB79
SHA256: AE3E856A3A707E9ED600A988A3855CDB5375DE93C2C54619741225404D2EDAD1
Sighted: 2019-03-08 [only single sightings used]
Kill chain Phase: Installation
Characterization: File Hash Watchlist

*****************************END***************************

CERT-IN General recommends:
• Users are advised to disable their RDP if not in use, if required it should be placed behind the firewall and users are to bind with proper policies while using the RDP.
• Restrict execution of Power shell /WSCRIPT in enterprise environment Ensure installation and use of the latest version (currently v5.0) of PowerShell, with enhanced logging enabled. Script block logging, and transcription enabled. Send the associated logs to a centralized log repository for monitoring and analysis.
• Establish a Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
• Don't open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization’s website directly
through browser.
• Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf.