Disable automatic cleanup of PUA

Question

Hey there. 
 
 I know this question has been asked a few years back, but i hope there is an update to this. 
 I deployed Sophos CIXA on my PC and it started automatically deleting some of my trusted software i use as a network technician. 
 The files are marked as PUA and therefore automatically cleaned up. i don&acute;t really want to exclude this software from scans. 
 
 Is there an option i missed to change automatic cleanup of PUA to "ask first" or be it "quarantine" ? 
 
 Thanks in advance for an answer :)

Qoosh · Accepted Answer

Hi Lukas_lzs , 
 Thanks for reaching out to the Sophos Community Forum. 
 It's not currently possible to prevent the automatic cleanup of PUA's. Additional information on remediation options can be found at the following link. - Threat Protection Policy > Remediation 
 I'd suggest creating a new Threat Protection policy for devices which will require access to these admin tools. You'll need to create an exclusion of the type "Potentially Unwanted Application (Windows/Mac)". The name you see referenced in the detection event will also be important, as this needs to be populated into the exclusion UI. 
 For example, in the following detection, you will need to enter "PsExec" as opposed to the path or exe name.

Disable automatic cleanup of PUA

Top Replies