Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 5 subscribers
  • Views 1440 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sandstorm not doing much (if anything)

JeffCooper

Hi All,

I understand safe file types like images are not scanned, but I've had this running for a week now. I personally have downloaded drivers and apps,  and I know staff have downloaded PDFs, xlsx, etc.  Yet the reporting pages say almost nothing is happening. The sandbox activity tab shows three things: one electric bill pdf, one email attachment, and a test I sent when setting it up.

Dual scan is enabled, so Sophos av is running so afaik it should be sending stuff to sandstorm.  "Enable Sandstorm" its enabled in smtp/malware. 

I personally do have some exceptions in place for myself, but antivirus and Sandstorm are not checked as skipped checks.

Before I submit a report ticket, I just want to make sure there isn't some random checkbox or setting I'm missing.

Thanks,

Jeff

 



This thread was automatically locked due to age.
Parents
  • 0

    With Firmware: 9.605-1

    the sandstorm view dont work 100%, the smtp protocol show more "sandstorm cached" entries (mail drop because malware) than the main sandstorm top activity area:

    --> The counter dont work (never work for smtp but for webfilter it does), but the diagram work like expected for smtp.

     

     

    The sandstorm activity area show only entries of the webfilter, there is never an entry of the mailprotection:

     

    Basicly, Sophos sandstorm engine works if you use the manual: https://community.sophos.com/kb/en-us/123912

    BUT it dont show the activity for smtp protection.

     

    It would great if sophos would fix it for a better feeling ;-)

Reply
  • 0

    With Firmware: 9.605-1

    the sandstorm view dont work 100%, the smtp protocol show more "sandstorm cached" entries (mail drop because malware) than the main sandstorm top activity area:

    --> The counter dont work (never work for smtp but for webfilter it does), but the diagram work like expected for smtp.

     

     

    The sandstorm activity area show only entries of the webfilter, there is never an entry of the mailprotection:

     

    Basicly, Sophos sandstorm engine works if you use the manual: https://community.sophos.com/kb/en-us/123912

    BUT it dont show the activity for smtp protection.

     

    It would great if sophos would fix it for a better feeling ;-)

Children
Unfiltered HTML