How to avoid risky download exe warning on specific website in Sophos Central Endpoint Protection

So its been nearly 10 months since this question was asked, did any resolution come of it?

This would be really nice, cause warning my users about ever document they pull off the company intranet is just making it to where they are ignoring the message all together.

Which is not what I want.

So its been nearly 10 months since this question was asked, did any resolution come of it?

This would be really nice, cause warning my users about ever document they pull off the company intranet is just making it to where they are ignoring the message all together.

Which is not what I want.

Hello Casey Moore,

Could you please provide more information regarding your Central settings for the Web Control policy?
Also, can you please provide some examples of what is being affected?

Here's some documentation that might help:

ConfigureWebControl

How to exempt a website

Regards,

Hi Barb,

Currently I am using a web control policy configured with the Additional Security Options, to block/warn for exe,msi,and pdfs.

However despite specifying a tagged website within the policy as "allow" documents accessed from the site are still blocked/warned.

The Additional Security Options appear to be separate from the Web tagging.

Edit: Also after some testing the first web control policy a user hits that has the Additional Security Options configured is the settings that apply to a user.

regardless of what sites are configured in website management. Essentially that setting does not "Waterfall" 

Hi Casey Moore,

If possible, Can you please PM the site and the files that you are trying to access from the website? We would try recreating it in my lab environment and see what exactly is happening here.

Hello!

Was there any solution for this?

We are looking at the exact same situation - our users are warned when downloading content from the Intranet... (e.g. finished exes from the build server)

Thank you!

I moved my deployment website to https which is not checked/blocked.

Paul

Thank's Paul!

We'll do the same then and report back. But anyhow - this is not a real solution @Sophos! 
Would be nice to add a exception list inside the policy...

You can exclude the server by IP and it will not block/warn or anything which seems OK at least for Intranet sites.

https://central.sophos.com/manage/config/settings/scanning-exclusions
Add the IP as a website.

You can also make the exclusion in a threat protection policy rather than globally if needed.

Regards,

Jak

Thanks Jak - that seems to work.  (Just over a year to get a working answer!)

Paul

THANK YOU!!!!

It was one of the first things I tried but I did it by hostname, which didn't work.