Very Poor Support

Question

We continue to experience VERY poor support. Techs seem unable to review the ticket and notes before asking questions already answered. We've yet to have an experience with Support where our issue is addressed by someone able to solve the issue. 
 Opened a critical issue. Spent time documenting and attaching screenshots of the issue. Tech asks for exactly the data given them. 24 hours of asking for the ticket to be escalated- it gets transferred to another technician who proceeds to do the exact same thing. Issue remains unresolved nearly 2 days later. 
 We made a change with notifications for encryption alerts, turned them on for a day and turned them back off. Now we no longer receive any alert emails. Luckly we have a 3rd party with an API connection to sophos or we would have missed 2 High priority and 3 medium priority Threat Graph events. 
 This is not acceptable.

Qoosh · Answer

Hi Cameron , 
 Apologies for the poor experience you had in working with Sophos Support. I've reached out internally to flag this case with our management teams so that it may be reviewed. 
 If you feel that you are not being assisted in a reasonable manner, you can also escalate your support case via the Sophos Support Portal. Steps on how to do so can be found at the following link. - Escalate a case 
 Looking into the details on the case, I see that the current issue is with Threat Graph creation and the origin of the Threat Graph. In Sophos Central, the creation of Threat Graphs will not trigger alerts. This is likely why API's were set up so that you do remain informed about activity on your environment. I've linked a section in our Alerts documentation below for additional context. 
 Alerts that are resolved automatically are not shown. To view all events, go to Logs & Reports > Events. 
 One situation in which this will occur is where the original detection does not get resolved automatically. In this case, you will receive an alert for the specific detection which was raised. You can then look into the Threat Graphs area to gain additional insight into the detection and any additional actions which may have taken place surrounding it. 
 Hopefully, this helps give some additional context surrounding the lack of alerts/emails, though if anything is unclear, please do let me know, and I'd be happy to help.