Exclude Behavior from Monitoring

Hi rfrutiger,

Thanks for reaching out to the Sophos Community Forum. 

It is not currently possible to exclude items or processes from generating Threat Graphs in Sophos Central. 

Threat Graphs are intended to be a supplementary information source for when you have a legitimate threat or detection generated on your environment. 

Based on the behavioural monitoring that Sophos utilizes, Threat Graphs will be created based on the nature of operations that are observed on your devices, though this does not always mean that an active threat is present. If you were to see a legitimate detection generated on a device, followed by a related threat graph, you could yield additional information from it. If you're using a known good application which your organization utilizes regularly, the related threat graph can be ignored. 

In your specific situation, the threat graph creation is likely due to the actions your print driver performs, in launching CMD to execute a command.

Hi rfrutiger,

Thanks for reaching out to the Sophos Community Forum. 

It is not currently possible to exclude items or processes from generating Threat Graphs in Sophos Central. 

Threat Graphs are intended to be a supplementary information source for when you have a legitimate threat or detection generated on your environment. 

Based on the behavioural monitoring that Sophos utilizes, Threat Graphs will be created based on the nature of operations that are observed on your devices, though this does not always mean that an active threat is present. If you were to see a legitimate detection generated on a device, followed by a related threat graph, you could yield additional information from it. If you're using a known good application which your organization utilizes regularly, the related threat graph can be ignored. 

In your specific situation, the threat graph creation is likely due to the actions your print driver performs, in launching CMD to execute a command.