Mail alert Virus detection

Question

Simple question but I cannot find the setting in Central: 
 Where can I enable mail notification for virus found on endpoint? 
 Currently Sophos Central is sending mails mostly for things we don't care about. If malware was found - total silence, not even a notification on dashboard. 
 We have mail notifications enabled for warnings and critical.

Qoosh · Answer

Hi LHerzog , 
 Regarding the options shown on this page, you can find further details here . 
 The following example gives some good insight into this as well. 
 
 For example, if 5 endpoints in a customer account trigger an alert of the same type and the frequency setting is set to Daily, only the first alert generated for each endpoint will be sent in that 24-hour span. Any subsequent alerts of the same type will not trigger additional alert emails until that 24-hour period has elapsed. 
 
 Not all events will generate an alert. Regarding malware detection events specifically, if the detected items are cleaned up automatically, an alert will not be generated as no action is required. If cleanup fails or if user intervention is required, you will receive an alert. 
 You can use API's to generate an email based on the events generated in Sophos Central which may work. The following recommended read article was created specific to PUA detections, but can be modified for threat detections. - PUA Alerts Handling with SIEM Events API 
 Otherwise, you may want to raise a feature request for an option to be made available wherein all threat detections will generate an email alert.

Mail alert Virus detection

Top Replies