SANDSTORM questions

Question

Where is Sandstorm activity logged in real-time? 
 How often is the sandstorm Activities updated?

Sumel Singh · Accepted Answer

Hello Martin, 
 
Sandstorm activity is logged in three places: 
 
Dashboard: 
- Under "Today’s Threat Status" Widget, there is a row that displays how many items have been detected a malicious 
 
Advanced Protection: 
- Under "Advanced Protection Statistics - Today" the summary information for today's sandstorm activity 
 
Advanced Protection > Sophos Sandstorm > Sandbox Activity: 
- Displays information for all sandstormed items

The Dashboard at most tales 5 mins to update. 
 
The Advanced Protection summary sources information for 2 locations, some of which take at most 5 mins to update, others that take at most 30 seconds to update. 
Items that take at most 5 mins to update: Suspicious files, Excluded by policy, Malicious, Clean. 
Items that take at most 30 sec to update: Awaiting result, Sent for analysis, Average analysis time 
 
The Sandbox Activity page is updated in real-time, technically speaking it has at most a 30 second delay. 
 
Cheers, 
Sumel