"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
Proceed events are not always reported to the console (in the event viewer) when a web page in a category set to 'Warn' is accessed by a user and they proceed through the warning.
Paged accessed via HTTPS do not display 'Warn' or 'Block' pages to the end user. Web pages accessed via HTTPS and categorized to 'Warn' will automatically 'Proceed'.
First seen in Sophos Endpoint Security and Control 10.0
Sophos' LSP component needs the web browser to support SNI. For example: Internet Explorer on XP does not support SNI. The web page must also be accessed via a DNS address to generate an event.
To avoid this problem we recommend you use of a browser that supports SNI and, if possible, access the web page via a DNS name.
We may look into improving this limitation in a future product release.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.