A computer is no longer sending security heartbeats to Sophos Firewall

Hello VNCT,

Thank you for contacting the Sophos Community.

To confirm, Has this computer been removed from your environment?

Is the XG sending the Alert or Sophos Central? Have you removed the endpoint from Sophos Centra?

Regards,

Hello Emmosophos,

No, these computers are still in our environment. Computerwise, since We are a company with many off site locations. People will take their laptops home.

This alert don't happen for every laptop (which is a relief.) 

Sophos central is the instance which is sending the alert. 

I hope you have enough info for an solution now

Regards,

VNCT

Hello VNCT,

So I think we are having two different issues.

1) Are you expecting the computer to keep sending heartbeats when off-premises?

2) Do you only want to disable the heartbeat alerts from Sophos Central?

Regards,

Hello Emmosophos,

To answer your questions:

1. We expect the computer to keep sending heartbeats, however 100% can't be guaranteed and we understand that. So we don't really mind if doesn't send one for 1/2 seconds.

2. Yes, we only want to disable this specific alert.

Hello Emmosophos,

To answer your questions:

1. We expect the computer to keep sending heartbeats, however 100% can't be guaranteed and we understand that. So we don't really mind if doesn't send one for 1/2 seconds.

2. Yes, we only want to disable this specific alert.

Hi VNCT,

you can disable the alarm for this specific event.

Log into sophos central, go to alarms, click on the event you want to disable notification.

On the right side there is a dropdown button, here you can set the frequency in wich you get the notifications.

When you set it to never, you won't get any notification for this event.

Here is a screenshot in german:

Regards

Hello Philipp,

Thanks for your reply, however we don't see this action in our sophos environment. So unfortunately this isn't the solution i'm looking for.

Thanks anyway

Regards

Hello VNCT,

Can you send a screenshot of what you are seeing? When you go to Sophos Central Admin >> Alerts

Regards,

Hello Emmosophos,

The image below is what we see in the alert section in central admin (blacked out sections because privacy reasons)

As you can see, under the "actions" tab where Philipp did have the option to change the frequency we don't see this option.

Hello VNCT,

I have sent you a PM.

Regards,

Hello Emmanuel,

we are facing the same problem in our Enviroment with active HeartBeat-Restriction-Rule.

We already had an open case with our Distri and Sophos, but they couldn't really help us. We get 20-50 emails a day with this message. It is because computers are simply switched off or laptops are taken along. According to Sophos, this is due to a Windows 10 problem.
We would also like to disable the notification. Can you also send me the solution?

Thanks

Regards

 

Ask sophos for NC-13830. This is a product improvement for the issue with Windows Notebooks moving trough different locations.

I´ll give it a try. Thank you!