We have blocked Peer to Peer \ Chat Tools in the WEB CATEAGORY. This works well but Sophos does not display a standard message as seen below. The error below confuses our users and they report it as a issue on their PC, would have been good if Sophos…

Today I have been receiving detections for C2/Generic-A on my mac clients the offending process is /usr/libexec/trustd and it is reaching out to IP 104.18.21.226. This IP is owned by cloud flare and hosts alphassl.com so it seems to make sense that the…

Hello everyone, I have two Windows Servers that report the HitmanPro.Alert service as Stopped. Once I open windows services and try to manually start it I get this message: "Windows coul not start the HitmanPro.Alert service service on Local…

Hello, I've noticed that a new tab has been added recently for 'Unmanaged devices' in computers and servers, but the page doesn't get anything and loading keeps on with no items were found.

Does anyone else get 10+ threat cases created for a single detection? For example, Sophos picked up some phishing from Outlook and generated 10+ threat cases: I don't think the user would try 10 times to open this email attachment. Anyone have…

Hello, we have the license for Intercept X advanced which 600+ users are using, a month ago a started the trial for the Intercept X advanced with EDR on the same central account, all the machines switched to the trial license, now that the trial ended…

Hallo Leute, ich habe mal eine Frage zu den Sophos Endpoint Produkten. Wir nutzen in der Firma Sophos Central dort gibt es im Punkt Endpoints die Unterscheidung zwischen Clients und Servern. Was ist jedoch nicht verstehe ist folgendes: Bei den Servern…

Just starting with InterceptX for Server. Installation is complete, my Servers are communicating with the cloud. When I go to Live Discover I notice that some Servers are Offline, but in my Server overview I can see activity a few minutes ago. How can…

All of our users (AD) can work with any endpoint server or computer, through remnote desktop or Citrix, all of them are protected throught Sophos Intercept X. But I don't know if there is a centralized place to manage all my Sophos Central policies without…

Hello everyone, I have some questions regarding Sophos Central Computer groups: - Is it possible for a computer or server be part on 2 or more groups at the same time? - Is it possible to create some kind of automatic group assignation rule…

Hello! We're installing Intercept X Endpoint on machines that are not part of a domain. Unfortunately, this means users are appearing in Sophos Central as [Machine Name]\[User], for example MACHINE001\Employee1 MACHINE002\Employee1 While its the…

Hi all, I am trying to install Kali Linux from the Microsoft Store on Windows 10 20H2 but it is being blocked by Sophos as a PUA (due to the nature of the apps it uses). is there a way to allow install and use of this without Sophos scanning it? can…

Hello, beginning yesterday one MAC client managed in Central reported 792 PUA. This is massive mail spam, I can tell! The problem was, the PUA were not detected at one, they were detected over some time - so the mail flood never stopped. Even today…

Hi Everyone, [Update 1 - 08/11/18 @ 11:20 GMT] Changes have been made in Sophos Central to mitigate this issue. Customers should no longer find that disabling Intercept X Advanced on server consumes advanced licenses. ----------------------------…

We've managed to install "Intercept X Advanced for server" on a few servers instead of the standard protection. I can't find how to downgrade this. There used to be a way by selecting the server itself but this option seems to have been removed. The…

Hello I need a bit of guidance please. I had "Central Server Protection Advanced" on our Servers with "Sophos SafeGuard 8" throughout the company. All working together perfectly. I've enabled the new "Intercept X Advanced for Server" features in…

Hey Community, This KB article describes a problem where Sophos Central Endpoint and Intercept X causes Internet Explorer 11 to crash when browsing a Flash page. The fix is currently in development and will be pushed out to Central customers by the…

Hi, Can Sophos cloud detect/protect CrossRAT trojan - by the group Dark Caracal? Have came across with an article and it says the below. "CrossRAT a cross-platform remote access Trojan that can target all four popular desktop operating systems,…

We have more Intercept-X licensing than we do Sophos Endpoint Protection Advanced licensing. I understand how to manage the endpoints in the cloud with EPA installed on them- to activate I-X What I don't understand is how to install I-X by itself…

We've received reports from customers regarding software CAPITA SIMS not being able to upgrade successfully when Intercept X/Exploit Prevention feature is running. CAPITA SIMS is a software primarily used by UK Schools. Our Development team is investigating…

Some users may have experienced their endpoints reporting a status of "Policy non-compliance: Exploit prevention" after the release of Exploit Prevention 3.6.9 This issue has now been resolved. Sophos Central customers using 'Controlled Updates' may…

I'm getting the following log entry from Intercept X. The event does not appear in Sophos Central in the Root Cause Analysis so I do not have further information on it. I'm just wondering if this is something I should be concerned about. 11/9…

Just received my license for Sophos Central. Wanted to begin deploying MacOS Installer to some endpoints. - While in the Overview pane I click "Protect Devices". - This brings up all the downloadable install files, but I only see: - Endpoint Protection…

I am noticing a trend in the Root Cause Analysis on Sophos Central. Several of end user Surface Pros are getting flagged with Exploit ROP. When I checked with one user he said he was getting the warning message right after log in. This has been happening…