Sandstorm not doing much (if anything)

Hi All,

I understand safe file types like images are not scanned, but I've had this running for a week now. I personally have downloaded drivers and apps,  and I know staff have downloaded PDFs, xlsx, etc.  Yet the reporting pages say almost nothing is happening. The sandbox activity tab shows three things: one electric bill pdf, one email attachment, and a test I sent when setting it up.

Dual scan is enabled, so Sophos av is running so afaik it should be sending stuff to sandstorm.  "Enable Sandstorm" its enabled in smtp/malware. 

I personally do have some exceptions in place for myself, but antivirus and Sandstorm are not checked as skipped checks.

Before I submit a report ticket, I just want to make sure there isn't some random checkbox or setting I'm missing.

Thanks,

Jeff