Sophos Central Endpoint Protection

Question

Hello Guys, 
 
 i got a question regarding the Central Endpoint Protection. The Following situation: 
 
 One of our Customers has some Technicians which have to use alot of different Software. So if one of this software is considered a threat 
 the endpoint Protection ofcourse deletes the threat. So what i can do ofcourse is to add this wrong threat to the exceptions. 
 
 My Customer wants something else now they do not want Sophos to delete it immediately they want a pop up window to appear where the user can choose either its an exception or a real threat. I cant find this option, the only option i can find is to automaticly remove Malware is this even possible? 
 
 Thank you guys 
 Jason

Barb@Sophos · Answer

Hi Jason Klein, 
 By default Sophos will prevent execution and attempt to automatically clean threats: Sophos Central Dashboard: Alerts Section reports one or more 'Malware not cleaned up' alerts 
 You can change the Threat Protection Policy for that particular system, disable Automatically clean up malware, or turn off other features, although this will not change the behavior for PEs , and we do not recommend disabling Threat protection settings in general. Please take a look at the "Remediation" section of this document to see the available options. 
 We recommend reaching out to Sophos Labs to get any potential false positives reviewed, and if needed, re-categorized: How to submit samples of suspicious files to Sophos Here's the direct link to submit samples for review: Submit a Sample 
 Regards,