Sophos Central Data Loss Prevention "allow file transfer" Events not showing

Question

Hello, 
 I have a Data Loss Prevention policy rule set to log all USB file transfers across all Endpoints. However it seems the events are not being reported to Sophos Central. There are a small amount of events logged from over 2 months ago. There is nothing in the logs for 2 months now despite there being well over 1k peripherial usb devices logged. I was even experimenting with changing the rule to Allow after user confirm the other day which ended up blocking at least 5 USB events that I know of (apparently messages require the user to have local admin without which it just blocks). Those events are not in the Central logs. 
 I tested the rule today directly and confirmed the Endpoint does show the file transfers events locally, just not in the Central logs. Any ideas what's going wrong and how to fix this?

QC · Accepted Answer

Hello Kramarite , 
 yes, it's Secure Boot - whether DLP will be re-implemented remains to be seen. See also How Sophos uses Microsoft Detours . Can't say why these particular events appear in the console. 
 File types are "True File Types" - the scanner infers the nature from the contents, not the name. E.g. if your policy is set to block executables and you rename program.exe to NotAProgram.jpg DLP will block an attempted transfer. If v.v. you rename AnImage.gif to MyProgram.exe it will be permitted. OTOH File Name refers to "how the file is called" (the term name is overloaded, particularly in Windows). Thus if in the first example you add two File Name exclusions, NoAProgram.* and *.exe , neither will be blocked. 
 As to monitoring : As far as Endpoint is concerned Sophos' stance is that users should be aware of its existence and that it shouldn't permit general auditing. Where Desktop Messaging can be disabled (e.g. Application Control) a user nevertheless notices that an application is blocked. Furthermore there is no conclusive evidence that the user actually tried to run the application. Central collection of allowed data transfers would indeed permit to "spy" on users. 
 Christian