This is the most useless message.
Where in Central can you view what specific applications are in quarantine?
On the rare occasions where it does actually list the file as an alert, you can't even issue an instruction via Central to remove the offending file.
I shouldn't have to log on to a machine to deal with an issue, I should be able to do that from Central.
Hi Stuart James ,
Thank you for reaching out to the Sophos Community forum.
For this type of detection, you can check the affected device's Events in Sophos Central, and locate the detection event. Sophos Endpoint will take action if a threat is found. Generally, PUAs are cleaned up automatically. But there are also instances when a manual cleanup is needed. This is further explained in the following document:
You may also refer to the following document for more details on how to investigate a PUA or create an exclusion if it's a false positive.
Resolve PUA alerts
I hope this helps.
Hi Stuart James ,
Thank you for reaching out to the Sophos Community forum.
For this type of detection, you can check the affected device's Events in Sophos Central, and locate the detection event. Sophos Endpoint will take action if a threat is found. Generally, PUAs are cleaned up automatically. But there are also instances when a manual cleanup is needed. This is further explained in the following document:
You may also refer to the following document for more details on how to investigate a PUA or create an exclusion if it's a false positive.
Resolve PUA alerts
I hope this helps.
