How to avoid risky download exe warning on specific website in Sophos Central Endpoint Protection

RE: How to avoid risky download exe warning on specific website in Sophos Central Endpoint Protection

Casey Moore — Fri, 28 Sep 2018 10:19:25 GMT

THANK YOU!!!!

It was one of the first things I tried but I did it by hostname, which didn't work.

RE: How to avoid risky download exe warning on specific website in Sophos Central Endpoint Protection

Paul Warren — Wed, 26 Sep 2018 08:31:44 GMT

Thanks Jak - that seems to work. (Just over a year to get a working answer!)

Paul

RE: How to avoid risky download exe warning on specific website in Sophos Central Endpoint Protection

jak — Wed, 26 Sep 2018 07:28:37 GMT

You can exclude the server by IP and it will not block/warn or anything which seems OK at least for Intranet sites.

https://central.sophos.com/manage/config/settings/scanning-exclusions
Add the IP as a website.

You can also make the exclusion in a threat protection policy rather than globally if needed.

Regards,

Jak

RE: How to avoid risky download exe warning on specific website in Sophos Central Endpoint Protection

Alguth Gogekl — Wed, 26 Sep 2018 07:03:08 GMT

Thank's Paul!

We'll do the same then and report back. But anyhow - this is not a real solution @Sophos!
Would be nice to add a exception list inside the policy...

RE: How to avoid risky download exe warning on specific website in Sophos Central Endpoint Protection

Paul Warren — Wed, 26 Sep 2018 04:17:01 GMT

I moved my deployment website to https which is not checked/blocked.

Paul

RE: How to avoid risky download exe warning on specific website in Sophos Central Endpoint Protection

Alguth Gogekl — Wed, 26 Sep 2018 04:07:00 GMT

Hello!

Was there any solution for this?

We are looking at the exact same situation - our users are warned when downloading content from the Intranet... (e.g. finished exes from the build server)

Thank you!

RE: How to avoid risky download exe warning on specific website in Sophos Central Endpoint Protection

Gowtham Mani — Sat, 04 Aug 2018 06:52:15 GMT

Hi Casey Moore,

If possible, Can you please PM the site and the files that you are trying to access from the website? We would try recreating it in my lab environment and see what exactly is happening here.

RE: How to avoid risky download exe warning on specific website in Sophos Central Endpoint Protection

Casey Moore — Wed, 25 Jul 2018 13:08:56 GMT

Hi Barb,

Currently I am using a web control policy configured with the Additional Security Options, to block/warn for exe,msi,and pdfs.

However despite specifying a tagged website within the policy as "allow" documents accessed from the site are still blocked/warned.

The Additional Security Options appear to be separate from the Web tagging.

Edit: Also after some testing the first web control policy a user hits that has the Additional Security Options configured is the settings that apply to a user.

regardless of what sites are configured in website management. Essentially that setting does not "Waterfall"

RE: How to avoid risky download exe warning on specific website in Sophos Central Endpoint Protection

Barb@Sophos — Mon, 23 Jul 2018 14:46:36 GMT

Hello Casey Moore,

Could you please provide more information regarding your Central settings for the Web Control policy?
Also, can you please provide some examples of what is being affected?

Here's some documentation that might help:

ConfigureWebControl

How to exempt a website

Regards,

RE: How to avoid risky download exe warning on specific website in Sophos Central Endpoint Protection

Casey Moore — Mon, 23 Jul 2018 13:41:47 GMT

So its been nearly 10 months since this question was asked, did any resolution come of it?

This would be really nice, cause warning my users about ever document they pull off the company intranet is just making it to where they are ignoring the message all together.

Which is not what I want.