Controlled/blocked applications are showing up in the list of Allowed Applications - Sophos Central.

Question

I am testing the Sophos endpoint protection EAP, and have synchronized application control enabled. I am having an issue, where all the controlled application that are set to blocked are showing up as allowed, even applications I do not use, such as remote desktop, SSH, TightVNC, proxies ect.

How can these applications be blocked, and also frequently allowed the same time? i do not use any of the programs. Also, I have wireshark blocked, and the Endpoint Security informs me that it was blocked, but it not showing up in the list of blocked applications in Sophos Central.

Qoosh · Accepted Answer

I tested this a bit further and found relevant logs in the following location. Let me know if searching this logfile for the name of the app in question helps you find the relevant files that are triggering the detection. - C:\ProgramData\Sophos\Endpoint Defense\Logs\SSP.log

Qoosh · Answer

Thank you for providing me with access via PM. The reason you are seeing entries in the "Allowed Applications" report is due to the Application Control Policy setting "Detect controlled applications during scheduled and on-demand scans". 
 When the scan occurs, blocked applications will be detected but won't be blocked as they are not "running". When you run a blocked application, it will be detected and blocked right away. 
 This is made evident by checking the "Events" report from the main dashboard's Logs & Events menu. - From the main dashboard, select "Logs & Events" - Open the Events Report - Select "Application Control Events" and "Protection Issues" in the event type selector (this includes the event "Full system scan initiated") - Click Update on the upper right-hand side of the page 
 Regarding the results you're seeing on the Firewall, checking some of the discussions on the Sophos Firewall page may help, though I'd suggest raising another thread so the knowledgeable folks over there can assist you as well.

Controlled/blocked applications are showing up in the list of Allowed Applications - Sophos Central.

Top Replies