email alerts from Central

Thank you for reaching out to our community forum. 

Is the action set for your alerts has been set to "Immediately? Also, after you've set up your email alert, are you seeing new alerts on your Sophos central that aren’t being reported via email alert? 

and thank you for replying.

Yes, it is set to "Immediately". We have Sophos Central for like 2 years and i have tried really everything to get alerts.

One way to test if email alerts are working correctly is by downloading the "PSTools.zip". You can then run a right-click scan on the .zip folder that gets downloaded. 
This will generate a "Manual Cleanup Required" alert in Sophos Central and a subsequent email alert. 

Generally, Sophos Central will only generate an email alert if admin intervention is required either in Sophos Central or locally on a device. Automatic cleanup events following a detection will not generate an email alert. 

The section "Why do I not see an alert for every event received?" may help to explain the behaviour a bit more.

i can confirm that i received this mail alert but its just not enough..

So there is no way to get allerted for example about events from Threat Analysis Center? I can see quite a lot alerts there, some might be really important. Or get notified about some logs from General Logs / Events? I mean come on, that must be basic functionality.

Thanks

Regarding email alerts from the TAC:

   Sophos creates investigations if there's a detection with risk level 6 or above.
   You may also check out the following sections to know more about how this works.

   How Sophos creates investigations
   Create an investigation

If you are interested in pulling all of the events from the Threat Analysis Center specifically, our team is working on an API that will allow you to fetch events and data from the TAC.

For Event and Alert data you can use either the SIEM Integration API or the Common API. 

Regarding email alerts from the TAC:

   Sophos creates investigations if there's a detection with risk level 6 or above.
   You may also check out the following sections to know more about how this works.

   How Sophos creates investigations
   Create an investigation

If you are interested in pulling all of the events from the Threat Analysis Center specifically, our team is working on an API that will allow you to fetch events and data from the TAC.

For Event and Alert data you can use either the SIEM Integration API or the Common API.