Sophos URL Sample Submission - still a black hole without communication

Hi LHerzog, 

Please allow us some time while we follow up with our team internally regarding this. 

Hi LHerzog , 

I appreciate your patience! As suggested earlier, you can run the URL on Intelix, and if you're not satisfied with the categorization, you can disagree with it, which will later open a support ticket. You will be able to view and manage this ticket from your support portal. Please see "What if I do not agree with the results?" section of the following article - https://support.sophos.com/support/s/article/KB-000033301?language=en_US

Please note: 

• The Disagree option is only available for customers with validated Support Portal profiles.
• There is a one-day limit for submitting a disagreement and for re-analysis.

Thank you Yashraj S 

First I need to say it's a misleading topic of that KB Article - because reporting an URL is no file sample.

Submit samples of suspicious files to Sophos
KB-00003330119. Jan. 2023

Could you please add the 2 words "and URL" to it?

Then, after reading, I just found out, that intelix only creates a classic support case:

After submission, the sample is sent to SophosLabs for further analysis, and a case is created under your account which can be monitored from the Support Portal.

And there is no "Disagree" button here.

Can you tell me what I'm doing with my " customers with validated Support Portal profiles." Support profile all day - I've had countless support cases open with it.

Thank you Yashraj S 

First I need to say it's a misleading topic of that KB Article - because reporting an URL is no file sample.

Submit samples of suspicious files to Sophos
KB-00003330119. Jan. 2023

Could you please add the 2 words "and URL" to it?

Then, after reading, I just found out, that intelix only creates a classic support case:

After submission, the sample is sent to SophosLabs for further analysis, and a case is created under your account which can be monitored from the Support Portal.

And there is no "Disagree" button here.

Can you tell me what I'm doing with my " customers with validated Support Portal profiles." Support profile all day - I've had countless support cases open with it.

Thank you for sharing the screenshots, LHerzog ! 

I've inquired internally about this and will post an update here once I hear back from our teams. In the meantime, I've got confirmation that the URL has been reclassified and the updated classification should reflect in an hour. 

There were some backend issues ("It seems like we're having multiple contact entries for your email address ") with my account and it's assignments internally at Sophos so the "disagree" button was not shown on intelix for me.

Yashraj S helped to get this solved for me and is still on it for my colleagues.

Now I can use intelix and creates a "classic" support case, if you disagree. It works and due to that case, I get feedback on what happens with the file / URL.

In the meantime, there is now a new banner over the old submission form:

and there is the link to KB-000033301 about how to use intelix (quite long but detailled)

https://support.sophos.com/support/s/article/KB-000033301?language=en_US

 LuCar Toni posted that link already above.

I think you did a good progress with intelix and probably some day may retire the old submission form.

Thanks to all involved here.

Can you please verify, the intelix URL submission disagreement is passing through the full URL to the support case?

It looks like, it isn't:

06442818 / Intelix Disagreement - URL - ...

Support wrote: "It seems that the URL provided xxxxxxxxxxxxxxxxxxx

invalid/incomplete kindly re-submit the URL  through Sophos Support File Submission on the link below.

File Submission : https://support.sophos.com/support/s/filesubmission?language=en_US

So they want me now to use the old form that provides no feedback.

Hi Lherzog,

Regarding your case, I'm checking this with our Internal Team. Will keep you posted once I"ve got an update.

Hi LHerzog,

We got an update from our internal team and below is what they advise

We do plan to allow URL submissions via the intelixUI and then to be able to disagree and get a ticket etc., just as we do today for files. However, at the moment, URLs won't create a ticket in the same way as files. It’s still the old way.

We’re also working with support to get the process in place for URLs. However, we don't have a tentative time as to when this will be rolled out/implemented.

that is disappointing. file submission was always working with feedback when files have been analyzed. only URL submission was black holed.

Now you tell us, intelix is the new tool with all the cool features - use it!

and URL submission is not working....

Looking  at the support case it seems that for intelix URL disagreement all that is handled over to the support team is a part of the URL in the case description. Many URL sampled are probably too long for the description and are truncated so the poor guy at support just cannot do his work.

You should just put the full URL provided for intelix disagreement into the case details. Job would be done.

Hi LHerzog,

Apologies for the inconvenience, and thank you for the feedback.

Our team is aware of this and is actively working on updating the current process.

Thank you. I appreciate it.