How to interpret Event::Endpoint::CorePuaClean - manual cleanup needed or not?

RE: How to interpret Event::Endpoint::CorePuaClean - manual cleanup needed or not?

Robert_Smith — Fri, 15 Nov 2024 14:53:26 GMT

documentation does not appear to explain the result piece ("result: SUCCESS" and "result: NOT_FOUND" seem mutually exclusive)

Event::Endpoint::CorePuaClean PUA cleaned up: ''{2}'' "at ''{1}''

RE: How to interpret Event::Endpoint::CorePuaClean - manual cleanup needed or not?

Harshil_S — Fri, 15 Nov 2024 14:42:22 GMT

Hello Robert_Smith

The Sophos Central API will contain all the information, and this article will help you to understand what event results relate to.

Sophos Central Admin: Event types and descriptions for Sophos Central API

RE: How to interpret Event::Endpoint::CorePuaClean - manual cleanup needed or not?

Robert_Smith — Fri, 15 Nov 2024 14:31:41 GMT

sometimes all I have is API

based on "In general" and "suggest checking on the central", API alone does not sound like a reliable way to determine if threat was cleaned up successfully

It sounds like I MUST assume worst case and tell my customer manual cleanup may be needed every time i do not see "result: SUCCESS or result: DELETED"

RE: How to interpret Event::Endpoint::CorePuaClean - manual cleanup needed or not?

Harshil_S — Fri, 15 Nov 2024 07:29:55 GMT

Hello Robert_Smith

In general, if the Endpoint is unable to clean the threat or malware, then it raises an alert for manual cleanup. To verify the API result, I suggest checking on the central and co-relating the event coming from the API and the event appearing on central.