How to interpret Event::Endpoint::CorePuaClean - manual cleanup needed or not?

Hello Robert_Smith 

In general, if the Endpoint is unable to clean the threat or malware, then it raises an alert for manual cleanup. To verify the API result, I suggest checking on the central and co-relating the event coming from the API and the event appearing on central.

sometimes all I have is API

based on "In general" and "suggest checking on the central", API alone does not sound like a reliable way to determine if threat was cleaned up successfully

It sounds like I MUST assume worst case and tell my customer manual cleanup may be needed every time i do not see "result: SUCCESS or result: DELETED"

Hello Robert_Smith 

The Sophos Central API will contain all the information, and this article will help you to understand what event results relate to.

Sophos Central Admin: Event types and descriptions for Sophos Central API

documentation does not appear to explain the result piece ("result: SUCCESS" and "result: NOT_FOUND" seem mutually exclusive)

documentation does not appear to explain the result piece ("result: SUCCESS" and "result: NOT_FOUND" seem mutually exclusive)