Automatic reporting for Lockdown events
Currently lockdown events are requested on an ad-hoc basis by the administrator. This is a manual task and can only be performed individually for each server.
Lockdown events are potentially critical alerts and should be reported in real-time to Central's event viewer (and therefore SIEM).
This is under review for a future Lockdown release.
Dennis Boyd commented
+1, and really just better visibility into Lockdown events in general; while it's something I need to be more mindful of, for some reason I forget that a particular server has Lockdown enabled when a software upgrade or installation keeps failing. It's not until I remote into the server and see the toast notification that I realize why it's been failing. It would be nice if it was on the main Sophos endpoint window along with the other events rather than this strangely separated category of events that you have to manually run from the console.