would like to understand when manual cleanup is needed via API events/alerts alone
this field in API events/alerts I am not clear on:
Event::Endpoint::CorePuaClean 'result'
API RESULT UNDERSTOOD:
{"items":[{"descriptor":"C:\\Users\\SOMEUSERNAME\\Downloads\\viewpdftools.msi","processPath":"","result":"SUCCESS","sophosPid":"","suspendResult":"NOT_APPLICABLE","type":"file"}],"totalItems":1}
API RESULT UNCLEAR: (shall I assume manual cleanup is needed when I see this, no separate manual cleanup alert or event is triggered)?
{"items":[{"descriptor":"C:\\Users\\SOMEOTHERUSERNAME\\Downloads\\pdfguruhub.msi","processPath":"","result":"NOT_FOUND","sophosPid":"","suspendResult":"NOT_APPLICABLE","type":"file"}],"totalItems":1}
Hello Robert_Smith
In general, if the Endpoint is unable to clean the threat or malware, then it raises an alert for manual cleanup. To verify the API result, I suggest checking on the central and co-relating the event coming from the API and the event appearing on central.
Best Regards,
sometimes all I have is API
based on "In general" and "suggest checking on the central", API alone does not sound like a reliable way to determine if threat was cleaned up successfully
It sounds like I MUST assume worst case and tell my customer manual cleanup may be needed every time i do not see "result: SUCCESS or result: DELETED"
Hello Robert_Smith
The Sophos Central API will contain all the information, and this article will help you to understand what event results relate to.
Sophos Central Admin: Event types and descriptions for Sophos Central API
Best Regards,
documentation does not appear to explain the result piece ("result: SUCCESS" and "result: NOT_FOUND" seem mutually exclusive)
Event::Endpoint::CorePuaClean |
PUA cleaned up: ''{2}'' "at ''{1}'' |