Sophos URL Sample Submission - still a black hole without communication

You could use Intelix as well. support.sophos.com/.../KB-000033301

Hi LHerzog, 

Please allow us some time while we follow up with our team internally regarding this. 

Hey LuCar Toni what should Intelix be good for im my case? I cannot use it for recategorization.

Do you have a real world example? 

yes, Sophos is doing something on this URL for a week now: melix.github.io
I created a case for it. 06343736 

I used intelix to confirm it is shown as malware. but as written - i cannot use intelix for any change submission against sophos

Hi LHerzog , 

I appreciate your patience! As suggested earlier, you can run the URL on Intelix, and if you're not satisfied with the categorization, you can disagree with it, which will later open a support ticket. You will be able to view and manage this ticket from your support portal. Please see "What if I do not agree with the results?" section of the following article - https://support.sophos.com/support/s/article/KB-000033301?language=en_US

Please note: 

• The Disagree option is only available for customers with validated Support Portal profiles.
• There is a one-day limit for submitting a disagreement and for re-analysis.

Thank you Yashraj S 

First I need to say it's a misleading topic of that KB Article - because reporting an URL is no file sample.

Submit samples of suspicious files to Sophos
KB-00003330119. Jan. 2023

Could you please add the 2 words "and URL" to it?

Then, after reading, I just found out, that intelix only creates a classic support case:

After submission, the sample is sent to SophosLabs for further analysis, and a case is created under your account which can be monitored from the Support Portal.

And there is no "Disagree" button here.

Can you tell me what I'm doing with my " customers with validated Support Portal profiles." Support profile all day - I've had countless support cases open with it.

Thank you for sharing the screenshots, LHerzog ! 

I've inquired internally about this and will post an update here once I hear back from our teams. In the meantime, I've got confirmation that the URL has been reclassified and the updated classification should reflect in an hour. 

There were some backend issues ("It seems like we're having multiple contact entries for your email address ") with my account and it's assignments internally at Sophos so the "disagree" button was not shown on intelix for me.

Yashraj S helped to get this solved for me and is still on it for my colleagues.

Now I can use intelix and creates a "classic" support case, if you disagree. It works and due to that case, I get feedback on what happens with the file / URL.

In the meantime, there is now a new banner over the old submission form:

and there is the link to KB-000033301 about how to use intelix (quite long but detailled)

https://support.sophos.com/support/s/article/KB-000033301?language=en_US

 LuCar Toni posted that link already above.

I think you did a good progress with intelix and probably some day may retire the old submission form.

Thanks to all involved here.

Can you please verify, the intelix URL submission disagreement is passing through the full URL to the support case?

It looks like, it isn't:

06442818 / Intelix Disagreement - URL - ...

Support wrote: "It seems that the URL provided xxxxxxxxxxxxxxxxxxx

invalid/incomplete kindly re-submit the URL  through Sophos Support File Submission on the link below.

File Submission : https://support.sophos.com/support/s/filesubmission?language=en_US

So they want me now to use the old form that provides no feedback.