Currently the dashboard is not customizable. It does not offer the high-level view we need, specifically it does not show the threats that have been found. It only shows alerts like when a client misses updates. We need this because when the client finds a threat, we are not notified, even though we have settings indicating we want all medium and high priority notifications emailed. This does not come through unless Sophos decides it cannot resolve the issue.

As admins, we need to know if a certain computer, server, user is continually being attacked. Sure, we can dig down into the Sophos Central site and look for this but it becomes burdensome in an ever increasing "do more with less people, money, time" environment. Getting an email when a threat is found seems like a no-brainer and to choose not to send one or not to give the customer the option to get one is quite inconceivable to me.

when auditig the changes made to policies , the specifc app that was blocked or unblocked doesn't show clearly in the audit, instead it shows the name of policy and all apps that are in policy, which is alot of aps, it would be better to show just the change made to specifc app in the application control section, so that in the audit its easier to identify which app was changed, associated with user, name of policy . this would be really helpfull in transparancy and reduce the audit log being flooded with a massive list of apps that keeps growing day by day, if the specific change to the specific app was displayed this would really help .

I have a new feature request. Currently, Sophos Central can have AWS tied into it to grab information relating to instances that are registered within the Dashboard. It brings in Instance ID, start date, etc. and its able to track that information through the life of the server being registered within Sophos Central.
The Audit log contains the actions taken in Sophos Central with users and systems. We noticed that there is one action that is not currently being tracked, and that is when an AWS instance is terminated. There is no record, in the Audit Log, of the system being terminated. So the server goes from being online and registered, to deleted without any recording in the Audit Log.
We'd like to have it so that there is a delete or terminate record, in the Audit Log, when an instance is removed from AWS. This would better understand how AWS and Sophos Central are interacting, but also leave a trail of what is happening to a specific instance within the Dashboard.

As all product updates require a reboot, and in some cases cause the protections to fail until an update has occurred.

we would like to be able to schedule the product updates to occur with our monthly patching and reboot cycle.

Currently the schedule only allows for a weekly schedule.

The schedule should be granular enough to accommodate schedules like 2nd Saturday of the month or every 3rd Monday etc.

How will this new feature address your business requirements?:

1. it will allow us to continue to use this product without the fear an update will cause the product to be ineffective against threats without an update




2. it will allow us to apply the required reboots to soon after the product has been updated to have all new features working.

How would you rate the importance of this feature?; 1 = Critical

There are many events generated in Sophos Central that Lack any specific information that would be required to know what is going on.

For example

Threat Cases. These are advertised as providing you with the root cause analysis, however quite they never actually provide information on what actually happened. An example of this is the
Lockdown events. To see what actually occurred and was blocked you need to review the local hitman pro events, so how is this providing Root Cause Analysis ?

Another example is AV detections within containers like ZIP and MSG files. In Central only the MSG file is reported, however the SAV logs include the Attachment or File within the ZIP that was
detected. This information should be visible in Central

How will this new feature address your business requirements?:

1. It will provide what this product has been advertised as doing, Being a central repository for this information.

How would you rate the importance of this feature?; 1 = Critical