Sophos Central Admin

Sophos Central Adminhelp

ContentsAbout this Help.1Activate Your License. 2Overview. 3Dashboard. 3Alerts. 4Threat Analysis Center.20Logs & Reports. 36People. 59Devices. 70Global Settings. 92Protect Devices. 165Endpoint Protection. 180Dashboard. 180Logs & Reports. 181People.184Computers. 195Computer Groups. 204Policies.205Settings. 229Protect Devices. 265Encryption.274Dashboard. 274Logs & Reports. 274People.276Computers. 287Unmanaged computers. 296Computer Groups. 296Policies.298Settings. 303Protect Devices. 320Server Protection.322Dashboard. 322Logs & Reports. 323Servers.325Servers on AWS.336Policies.339Settings. 369Protect Devices. 403Wireless. 408Wireless Dashboard. 408Wireless Alerts.410Devices. 411Usage Insight.412Wireless Diagnostics. 412Access points. 419SSIDs. 425Sites. 438Settings. 441Email Gateway. 443Add mailboxes to Email Gateway. 443Domains Settings/Status. 444Policies and Settings. 445(2020/09/08)

Email Gateway Dashboard.446Message History Report.447Message Summary Report.448Advanced Threat Report. 449Time of Click Summary.450At risk users. 450Data loss prevention policy violations. 451People.451Mailboxes. 462Quarantined Messages. 465Policies.466Settings. 481Integrate Sophos Email with external services. 507Web Gateway.531Dashboard. 531Logs. 532Reports. 532People.532Computers. 543Policies.551Settings. 559Protect Devices. 581Firewall Management. 583Dashboard. 583Firewalls. 584Tasks queue. 605Dynamic objects. 606Backup. 607Phish Threat. 609Dashboard. 609Reports. 610People.611Campaigns. 622Settings. 629Cloud Optix.642Mobile. 643Free Trials. 644Trial license banners. 645Account and Licensing. 646Account Details.646Licensing. 650Early Access Programs.652Supported Web Browsers. 654Languages. 655Get additional help. 657Legal notices. 658(2020/09/08)

Sophos Central Admin1 About this HelpThis Help tells you how to use all the features in Sophos Central.If you can't find the help you need here, go to the Support section of our website and search there.This finds knowledge base articles or discussions in the Sophos Community.TipNot using Sophos Central yet? Sign in here and we'll help you get started.You can sign in with your Microsoft sign-in details if your administrator has set this up. Click Sign Inwith Microsoft and enter your Microsoft sign-in details.Copyright Sophos Limited1

Sophos Central Admin2 Activate Your LicenseWhen you buy a new license, you need to activate it.You do this in Sophos Central (unless a Sophos Partner handles license activation for you).When you buy an upgrade, it may be activated automatically or you may need to activate it.NoteIf you are starting a trial of Sophos Central, you don't need to activate a license yet. You do thisonly when you upgrade to a paid license.To activate a license, do as follows.1. Ensure you have the license key shown in the License Schedule that Sophos sent you.2. Look for your account name in the upper right of the user interface. Click the name and selectLicensing.3. Now use your license key. If you see Apply Activation Code, enter your key and click Apply. If you see an Apply License Key link, click it. Enter your key and click Apply.4. If your account already has licenses for the features included on the key, you see another dialog.This lets you choose how to use your new licenses. Renew starts the new licenses when your current licenses expire. Change starts the new licenses now. We'll adjust the license term so that all your licensesexpire on the same date.Click Apply again.How the "Change" option worksA customer orders 50 licenses for one year. Six months later, they place another order for 50licenses for one year.If the customer selects Change, we do as follows: Add the new licenses to the older ones. The customer now has 100 licenses. Add the remaining time on the older licenses (50 licenses x 6 months 300) to the time on the newlicenses (50 licenses x 12 months 600). The total is 900 months. Distribute the time over all 100 licenses. Each user’s license now runs for 9 months from the datewhen the key was applied (and the expiry date is adjusted accordingly).The customer now has 100 licenses that will all expire 9 months from now.In most cases the existing license expiry date gets extended but do check the new expiry dateshown.2Copyright Sophos Limited

Sophos Central Admin3 OverviewThe main menu lists the functions available to you in Sophos Central. These are listed under theirproduct names, for example Endpoint Protection.There is also an Overview that amalgamates the functions for all of your licensed products.3.1 DashboardThe Dashboard is the start page of Sophos Central and lets you see the most important informationat a glance. It consists of these areas.Most Recent AlertsMost Recent Alerts shows the latest few alerts. Informational alerts are for information only anddon't require you to take action.Click View All Alerts to see all alerts.Devices and users: summaryDevices and users: summary shows details of usage and protection for users or protected devices.It also shows the number of unprotected users or devices.Click on the tabs to see information for each device type or for users.Click See Report to open a detailed report for the tab you have selected.Email SecurityInbound shows information about the following message categories: Legitimate: Messages that are classified as clean, and therefore delivered. DLP policy violations: Messages that violated Data Loss Prevention policies. Spam: Messages classified as spam. Advanced threat: Messages classified as containing advanced threats. Virus: Messages classified as containing viruses. Authentication failure: Messages that failed authentication checks by DMARC, SPF or DKIM. Realtime blocklist: Messages detected due to a blocked sending IP. Company blocklist: Messages sent from an address that has already been added to thecompany blocklist (inbound allow/block).Outbound shows the total number of outbound email messages scanned by Email Security foryour protected mailboxes for the last 30 days. It also shows the number of legitimate messagesprocessed, the number of spam and virus messages detected and the number of messages violatingDLP policies.Copyright Sophos Limited3

Sophos Central AdminClick See Report to open the Message Summary report and review the details of the processedmessages, see Message Summary Report.Web controlWeb control shows statistics for your Web Control protection.The figures are for threats blocked, policy violations blocked, and policy warnings. There is also afigure for "policy warnings proceeded", which is the number of users who have bypassed a warningto visit a website.Click on a figure to open a detailed report.Web Gateway Blocked SummaryWeb Gateway Blocked Summary shows statistics for your Web Gateway protection (you see thisonly if you have a Web Gateway license).The figures are for malware blocked and websites blocked.Click on a figure to open a detailed report.Related conceptsMessage Summary Report (page 56)The Message Summary report details the email messages processed by Email Gateway for yourprotected mailboxes.3.2 AlertsThe Alerts page lists all the alerts that require your action.RestrictionSome features might not be available for all customers yet.Alerts that are resolved automatically are not shown. To view all events, go to Logs & Reports Events.NoteThe alert event time is not updated if the same event occurs repeatedly.On the Alerts page, you can do as follows: Group alerts. Filter alerts. Take action against alerts. Change the frequency of email alerts.For information about the different types of alerts, see the other Help pages in this section.4Copyright S

Sophos Central Admin 2 Activate Your License When you buy a new license, you need to activate it. You do this in Sophos Central (unless a Sophos Partner handles license activation for you).