Disable Mail Notification only for Third-Party Active Threat Response

Hi Speedfish Thank you for reaching out to the Sophos community team. Based on shared details it seems you are looking for a separate checkbox for Email notification for 3rd party thread feed. Unfortunately on the GUI as of now no such settings or options are there to define it separately and it applies to all 3 [MDR, Sophos X-Ops, and Third-Party Threat Feed] in terms of Email alerts.



You can submit your Feature Request using the in-product feedback in the Sophos Firewall, located in the Top Menu Bar.



You can also log a support case to raise a feature request which you can track it later with your channel account manager/local sales representative or TAM.

Hello Vishal_R

yes thats 100% what I am looking for and its unfortunately not possible to define like I described as you confirmed.

Thank you anyway I will follow your guidance and I will try to raise a feature request ticket.

We have this on our radar, as this came up in the EAP as well. 

Basically all systems use the ATP to generate and do something. We are looking into changing this behavior, which is not that easy in ATP itself. 

Do you get those notifications from LAN to WAN Traffic, or WAN to LAN? 

Oh that sounds very promising thanks for the heads up.
Those mail notification include LAN to WAN and WAN to LAN.

Example:
LAN to WAN (DNS Query)

Example:
WAN to LAN

We changed the behavior of WAN to LAN, to make ACLs hit first. So you could potentially create a ACL Exception Rule and block a lot of countries, which should not talk to you. This would reduce this kind of WAN to LAN Alerts. 
The LAN to WAN Alerts are still there for now. 
I am also talking about this situation here: v21 Third Party Feeds Because generally speaking, i am seeing a lot of customers using a lot of "data sources" which they do not know, how well maintain they are.