Sophos Central - False positive - Connectwise Screenconnect - a Thoma Bravo Company - Same as Sophos

Hi Dennis,

Thanks for reaching out to the Sophos Community Forum. 

If you wish to white-list the app locally on your environment, I suggest checking the "Details" button on the ML detection event that was generated. 

To have this adjusted globally for the specific version of Screenconnect you're using, you'll need to submit a sample of the detected file so that our ML engine can be updated. You can do this from the following webpage. 
- Submit a Sample

If you require immediate assistance after-hours, the best way to get support is to reach out using the regional contact numbers on the following page. If you have a business-critical issue, and your team is available 24/7 to continue working on the issue with us, our team will use the follow-the-sun process to assist you. 
- support.sophos.com

If you feel that you are not being assisted in a reasonable manner, or if there is an issue you wish to highlight to our management team regarding your experience in working with Sophos Support, you can always reach out to SupportEscalations@sophos.com as well. The case will be reviewed as a whole to ensure we're delivering a high-quality support experience. 

I hope this gives you some insight into things and provides some possible avenues for you to reach out to us should any issues arise. 

Thanks for the reply
- sample is hard as sophos deletes it
- can i whitelist globally for all customers from central or do i have to go thru 1 by 1

Thanks for the reply
- sample is hard as sophos deletes it
- can i whitelist globally for all customers from central or do i have to go thru 1 by 1

If you have a Global Template applied currently with the "Allowed Applications" section controlled. It's possible to add an exclusion for the ML PUA type detections. 

You can add the exclusion via SHA256 value or Path.

If you are not currently controlling the "Allowed Applications" section for your customers, I'd suggest checking within the tenant sites to ensure you won't be overwriting any configurations they already have applied. 

For an even further laugh - one of our MDR clients got a report yesterday with 400 "activities" compared to the usual 1 or 2 
Customer not laughing tho.