Sophos Cloud Help Document date: January 2016

Transcription

1 Sophos Cloud Help Document date: January 2016

2 Contents 1 About Sophos Cloud Help Activate Your License The Sophos Cloud User Interface Dashboard Action Center Alerts Account Summary Sophos Labs Global Activity Resolved Malware Detections Web Statistics Web Gateway Statistics Users & Devices Users Groups Devices User Policies Active Directory Enable ios Support Servers Servers Server Policies Network: Firewall Reports Summary Users Servers Computers Mobiles Mobile Security Peripherals Events Application Control Reports

3 8.10 Web Reports Web Gateway Reports Global Settings Web Control Customizations Scanning Exclusions Tamper Protection Manage Update Caches Configure Updating Downloads Downloads for Workstations Downloads for Servers Downloads for Virtual Environments Downloads for Mobiles Account Administration Contact Details Partner Details Payment Methods Statements Join The Beta Program Supported Web Browsers Contact Sophos Support Legal notices

4 Sophos Cloud 1 About Sophos Cloud Help Sophos Cloud is a web-hosted solution which offers seamless protection and policy enforcement for users across all devices as well as for networks. This Help file provides additional information and explains procedures step by step. You can help us to improve the Help by posting suggestions or comments using the Support link in the top right of the user interface. Tip: For news about the latest improvements in Sophos Cloud, see What s New.You can access What's New at any time by using the link in the top right of the user interface. Accessing the Help The Help can be opened by clicking the Help link in the main menu or any blue question mark you see in the user interface. The Help always opens in a separate window. As the Help is context-sensitive, clicking a question mark in a certain section opens the topic related to that section. So you do not have to browse the Help for the correct topic. Using the Help The Help consists of a navigation pane on the left side and the topic pane on the right side. Navigation pane: The navigation pane contains two tabs the Content tab and the Search tab. The Content tab gives an overview of all topics covered by the Help. The Search tab lets you search the whole Help for the word or words you specify. Results are presented in the topic pane in the way search engines present web results, in the order of relevance. Clicking the link of a result opens the respective topic in the topic pane. The search term is highlighted. Topic pane: Here the currently selected topic is displayed. You can also download a PDF version of the Online Help by clicking the PDF button. The With Frames button displays the output using HTML frames to render two separate sections: a section that presents the table of contents on the left and a section that presents the content of a topic on the right. The "with frames" layout is displayed if JavaScript is disabled in the browser. Tips & Tricks Hidden text: Often you can find additional information by clicking on drop-down arrows. Closing the navigation pane: You can close the navigation pane by clicking the arrow located on the bar between the navigation and the topic pane. 4

5 Help 2 Activate Your License When you buy a new or upgraded license, you need to activate it. You do this in your Sophos Cloud console (unless a Sophos Partner handles license activation for you). Note: If you are starting a trial of Sophos Cloud, you don't need to activate a license yet.you do this only when you upgrade to a paid license. To activate a license: 1. Ensure you have the License Activation Key shown in the License Schedule that Sophos sent you. 2. Go to the Account link and select Administration. The Account link is on the right of the user interface. 3. On the Administration page, the Review licenses and current usage section is open by default. Go to the Apply Activation Code field, enter your Key and click Apply. 5

6 Sophos Cloud 3 The Sophos Cloud User Interface The user interface of Sophos Cloud is divided into a header, a main menu, and the main frame. The latter displays the content of the currently active menu. At the bottom of the page, you find links to Sophos legal information as well as Sophos policies on privacy and cookie use. Header Apart from the product name and logo, the header shows details of the user logged on. It also has these links: Logout closes the session and deletes all cookies. What's New opens a web page that tells you about new features in Sophos Cloud. Support opens a dialog which allows you to send an to Sophos Support (page 103). Main Menu The main menu lets you access the main functions of Sophos Cloud. Dashboard displays an overview of your current security status and actions that need to be taken. Users & Devices lets you manage users and user groups, security policies, and deployment of Sophos Cloud agent software to devices. Servers lets you manage servers and server security policies. Network lets you view Sophos Firewalls registered with Sophos Cloud. Reports lets you see reports for the different security features of Sophos Cloud. Global settings lets you specify security settings that apply to all users and servers. Downloads lets you download Sophos software. Account lets you manage licenses, passwords, and administrator accounts. Help opens the online Help. Since the Help is context-sensitive, the topic relevant to the page you are currently on is displayed. 6

7 Help 4 Dashboard The Dashboard is the regular start page of Sophos Cloud and provides access to the most important information at a quick glance. It consists of the three areas: Action Center. Account summary carousel displaying user summary, computer summary, server summary, and mobile summary (depending on your licenses). Event summary carousel displaying statistics on Sophos Labs global activity, web activity by your users, and resolved malware detections on your managed computers. The areas are described on the following pages. The left and the right pane of the Dashboard refresh automatically every five minutes, independently from each other. 4.1 Action Center The Action Center on the Dashboard shows the actions that are currently required. Note: Only alerts that require your action are displayed in the Action Center. Alerts that are resolved automatically by Sophos Cloud are not displayed. For example, if malware has been detected and then cleaned up successfully, no alerts are displayed. If you want to view all events that occurred on devices monitored by Sophos Cloud, go to the Reports > Events page. Action indicator The image at the top indicates with three different colors if there are urgent issues that need handling: High Immediate action is required. There is at least one critical alert. Medium There is at least one alert of medium importance. Informational There is at least one informational alert. Alerts In the lower part of the Action Center there is an alerts list. Alerts are grouped together by their type. Click on a group title to display all alerts of that type, starting with the newest. For information about the different types of alerts, see the other Help pages in this section. Note: The alert event time is not updated if the same event occurs repeatedly. 7

8 Sophos Cloud Actions on alerts There is a checkbox next to each alert and alert group. When you select one or more checkboxes, you can apply certain actions on alerts. The action buttons are displayed at the bottom of the table. Tip: If you select the checkbox of an alert group, you can apply an action to all underlying alerts at once. The following actions may be available, depending on the alert type: Ignore Alert You can ignore any alert. It will not be displayed again. Reinstall computer software Clicking this action button takes you to the Downloads page where you can download the agent software. Contact Support This action becomes available for example when malware cleanup fails. Clicking the button opens a dialog window which allows you to send an to Sophos Support (page 103). Cleanup PUA(s) This action enables you to clean up a Potentially Unwanted Application (PUA) that has been detected. This action is available only for computers and is not available for mobile devices. Note: This action might not be available if the PUA has been detected in a network share. This is because the Sophos Cloud agent does not have sufficient rights to clean up files there. For more information on dealing with PUAs, see Alerts for Malware Protection (page 9). Authorize PUA(s) This action enables you to authorize a Potentially Unwanted Application (PUA) to run on all computers. You might do this if you consider the application useful. This action is available only for computers and is not available for mobile devices. Send Message This action allows you to send a text message to the mobile device when the device is not compliant or when malware or PUA has been detected on the device. This action is available for Android devices that have the Sophos Mobile Security or Sophos Mobile Control app installed and are managed by Sophos Cloud Alerts for Deployment, Updating and Compliance There are the following types of deployment, updating and compliance alerts: High Failed to protect computer or server A computer has started installation of the agent software but has not become protected for one hour. The installer that has been run on the affected computer may provide more information about the reason of the failure. Medium Computer or server out of date 8

9 Help A computer that has not been updated in the last 24 hours has been communicating with Sophos Cloud in the last 6 hours, and did not update in the following 2 hours. Normally, a computer will attempt to update about 5 minutes after it has been started, and then regularly every 60 minutes. If re-applying fails repeatedly, it may be due to a more serious problem. In those cases, re-installation may solve the problem. Reboot required The reboot of a computer is needed to complete an update of the agent software, but the computer has not been rebooted for 2 weeks. Sometimes, after installing/updating the agent software, a reboot is needed to fully enable the capabilities of the new/updated version of the software. Although an update does not need to be performed immediately, it is advisable to perform it as soon as possible. Policy non-compliance A device may not comply with a policy for various reasons, for example because the settings have been changed on the device itself. In that case, after two hours of non-compliance, the system will raise an alert and will try to re-apply the corresponding policy. When the device is back in compliance, the Action Center alert will be automatically cleared. If re-applying fails repeatedly, it may be due to a more serious problem. In those cases, re-installation may solve the problem. Peripheral detected A removable media or peripheral device has been detected on a device monitored by Sophos Cloud. For information about managing peripherals, see Configure Removable Media and Peripherals Control (page 35) Alerts for Malware Protection There are the following types of malware protection alerts. Tip: For information about a threat and advice on how to deal with it, click its name in the alert. Alternatively, go to the Threat Analysis page on the Sophos website. Under Browse threat analysis, click the link for the type of threat, and then do a search for the threat or look in the list of latest items. High Real-time protection disabled Real-time protection has been disabled for a computer for more than 2.5 hours. Real-time protection should be turned on at all times. Sophos Support may advise you to turn it off for a short period of time in order to carry out an investigation. Malware not cleaned up Some detected malware could not be removed after a period of 24 hours, even if automatic cleanup is available. Probably, the malware was detected via a scan that does not provide 9

10 Sophos Cloud automatic cleanup, e.g., an on-demand scan configured locally. You can deal with the malware in one of these ways: Clean it up centrally, by scheduling a scan in the policy (which will then have automatic cleanup enabled). Clean it up locally, via the Quarantine Manager. Manual cleanup required Some detected malware could not be removed automatically because automatic cleanup is not available. Click on the alert and the link will take you to the Sophos website, where you can read advice on how to remove the threat. If you need help, contact Sophos Support. Running malware not cleaned up A program that was running on a computer and exhibited malicious or suspicious behavior could not be cleaned up. Click on the alert to learn more about the threat and how to deal with it. If you need help, contact Sophos Support. Malicious traffic detected Malicious network traffic, possibly headed to a command-and-control server involved in a botnet or other malware attack, has been detected. Click on the alert to learn more about the threat and how to deal with it. If you need help, contact Sophos Support. Recurring infection A computer has become reinfected after Sophos Cloud attempted to remove the threat. It may be because the threat has hidden components that haven't been detected. An in-depth analysis of the threat may be required. Please contact Sophos Support for assistance. Medium Potentially Unwanted Application (PUA) detected Some software has been detected that might be adware or other potentially unwanted software. By default, potentially unwanted applications are blocked. You can either authorize it, if you consider it useful, or clean it up. Authorize PUAs You can authorize a PUA in one of two ways, depending on whether you want to authorize it on all computers or only some: Click the Authorize PUA(s) button in Action Center. This authorizes the PUA on all computers. Add the PUA to the scanning exclusions in the malware protection policy. This authorizes the PUA only on computers to which the policy applies. Clean up PUAs 10

11 Help You can clean a PUA up in one of two ways: Click the Cleanup PUA(s) button in Action Center. Clean it up in the agent software's Quarantine Manager on the affected computer. Note: Cleanup might not be available if the PUA has been detected in a network share. This is because the Sophos Cloud agent does not have sufficient rights to clean up files there. Potentially unwanted application not cleaned up Potentially unwanted application could not be removed. Manual cleanup may be required. Click on the alert to learn more about the application and how to deal with it. If you need help, contact Sophos Support. Computer scan required to complete cleanup A threat cleanup requires a full computer scan. To scan a computer, go to the Users & Devices > Devices page, click on the name of the computer that you want to scan, and then click the Scan Now button. Note: The scan may take some time. When complete, you can see a "Scan 'Scan my computer' completed" event and any successful cleanup events on the Reports > Events page. You can see alerts about unsuccessful cleanup in the Action Center. If the computer is offline, it will be scanned when it is back online. If a computer scan is already running, the new scan request will be ignored and the earlier scan will carry on. Alternatively, you can run the scan locally using the Sophos Cloud agent software on the affected computer. Use the Scan my computer option in Sophos Endpoint Security and Control on a Windows computer, or the Scan This Mac option in Sophos Anti-Virus on a Mac. Reboot required to complete cleanup The threat has been partially removed, but the endpoint computer needs to be restarted to complete the cleanup Alerts for Mobile Devices There are the following types of mobile device alerts: High Your APNS certificate will expire soon If your APNS certificate will expire within the next 7 days, this alert is of high importance. A valid APNS certificate is needed for communication between Sophos Cloud and ios mobile devices. Renew it as soon as possible. See APNS Certificate Renewal (page 51) for information on how to do that. Your APNS certificate has expired 11

12 Sophos Cloud As your certificate has expired, communication between Sophos Cloud and ios devices is no longer working. Renew it as soon as possible. See APNS Certificate Renewal (page 51) for information on how to do that. Medium Mobile device decommissioned by user A user has deleted the Sophos Mobile Control app or removed its configuration (this cannot be prevented). The mobile device is now unmanaged. It will lose its connection to the company network if this network connection was specified in a policy (see Configure Wi-Fi Settings (page 39)). Action for mobile device failed The kind of action that failed for the mobile device is specified in the corresponding events. Mobile Exchange settings could not be applied (missing account information) and Please add missing Exchange information Exchange settings can only be applied if both the Exchange and the Exchange login are available. Unless you configured a policy containing specific user information, this account information is taken from the user details. You find them under Users & Devices > Users. See also Users (page 17). Unable to deploy to ios devices. Please configure the APNS certificates first. A valid APNS certificate is needed for communication between Sophos Cloud and ios mobile devices. See APNS Certificate Creation (page 50) for more information on how to get one. Your APNS certificate will expire soon If your APNS certificate will expire in 7-14 days, this alert is of medium importance. User unenrolled Device Management (or Security Management) app The user has unenrolled the Sophos Mobile Control or Sophos Mobile Security app and the respective policy can no longer be applied to the device. The mobile device is now non-compliant The device is not compliant if any compliance rule specified in the policy or policies valid for this device is violated. Malware detected Malware detection is available only with the Sophos Mobile Security app for Android. Automatic cleanup is not possible on Android, so the user needs to remove malware from the device himself. PUA detected A potentially unwanted app has been detected. The user needs to remove it from the device himself. 12

13 Help Low reputation app detected A low reputation app has been detected. The user needs to remove it from the device himself. Low Action for mobile device succeeded The kind of action that succeeded for the mobile device is specified in the corresponding events. Action for mobile device has been canceled The kind of action that was canceled for the mobile device is specified in the corresponding events. Mobile device is not compliant A device is not compliant if any of the requirements specified in the policy valid for this device is not met. For more information, see Configure Compliance Rules (page 40). Mobile device enrolled A mobile device is enrolled. New Device Management (or Security Management) app enrolled The Sophos Mobile Control or Sophos Mobile Security app has been enrolled. Malware cleaned up The user removed malware from the device. PUA cleaned up The user removed PUA from the device. Low reputation app cleaned up The user removed low reputation app from the device. URL blocked due to threat A malicious website has been detected and blocked. Malicious websites are blocked if the block option is selected in the Web Protection section of the mobile security policy for Android devices. URL warned due to threat The user had been warned about a malicious website and did not proceed to the website. The user is warned about malicious websites if the warn option is selected in the Web Protection section of the mobile security policy for Android devices. The user can then choose whether to proceed to the website or not. User bypassed threat block to URL 13

14 Sophos Cloud The user had been warned about a malicious website but chose to proceed to the website anyway. Informational Your APNS certificate will expire soon If your APNS certificate will expire in days, this is just an informational alert. Your APNS certificate was renewed This is to confirm that the certificate was renewed Alerts Sophos Cloud automatically sends alerts to administrators when events occur (for example, "Potentially Unwanted Application detected"). Sophos Cloud does as follows: Sends alerts for Medium or High severity events that require action. For details of events in these categories, see Action Center (page 7). Sends alerts to all the administrators in your administrators list on the Account > Administration page. Does not send alerts if an alert for the same type of event has been sent within the previous 24 hours. Note: You cannot change the alert settings. 4.3 Account Summary The account summary carousel provides an "at a glance" view of the status of your users, computers, servers, and mobile devices. User Summary: Shows how many users are active, inactive for over two weeks, inactive for over two months, or not protected. Computer Summary: Shows how many computers are active, inactive for over two weeks, inactive for over two months, or not protected. Server Summary: Shows how many servers are active, inactive for over two weeks, inactive for over two months, or not protected. Mobile Security Summary: Shows how many mobiles need attention, have warnings, are in good health, or are not protected. Mobile Summary: Shows how many mobiles are managed or not managed. Clicking on the Go To Report link in this view opens the respective report that provides more detailed information. If you haven't yet added any users, protected any computers, or enrolled any mobile devices, the graphs will appear gray. Instead of the Go To Report link you will see a Manage Users, Protect Computers, or Enroll Mobile Devices link respectively. Follow the links to set up your Sophos Cloud. 14

15 Help 4.4 Sophos Labs Global Activity The Sophos Labs Global Activity graph on the Dashboard shows the world-wide threat level and indicates when Sophos has released updates to protect against new threats. At the top of the graph there is a four-step threat level indicator which ranges from green over orange to red. The colors result from an estimation by Sophos Labs of the current prevalence of malware, spam, and web threats, and intelligence regarding new vulnerabilities. The four threat levels are rated as low, medium, high, or critical. More information is available at sophos.com. The graph consists of a light-blue curve in the background. It depicts the overall detections of new malware world-wide. In the foreground, there are different kinds of markers. Hovering on a marker reveals information on the item in a small overlay window. Threat Update A blue virus icon indicates malware markers. The information given comprises the name of the malware, its type, its prevalence, and the date when we updated our protection against it. News Update A blue paper sheet icon indicates news from Sophos Naked Security, which is the news weblog site of Sophos. You can adjust the time scale of the graph by selecting D (Day), W (Week), or M (Month) in the lower right of the pane. 4.5 Resolved Malware Detections This graph provides reporting information on malware detections on your managed computers that have been resolved.you see information on which user was affected and how many malware instances were detected. You can adjust the time scale of the graph by selecting D (Day), W (Week), or M (Month) in the lower right of the pane. 4.6 Web Statistics The Web Statistics pane of the Dashboard provides an overview of the status of web control, and provides a link to the related activity report. You can see the following: Web Threats Blocked: This shows the number of threats. The link opens the Top Malware Downloaders report. Policy Violations Blocked: This shows the number of policy violations. The link opens the Top Policy Violators report. Policy Warnings Issued: This shows the number of warnings issued to users. The link opens the Top Warned report. Policy Warnings Bypassed: This shows the number of users who have bypassed a warning. The link opens the Top Warned report. You can adjust the time period displayed by selecting D (Day), W (Week), or M (Month) in the lower right of the pane. 15

16 Sophos Cloud 4.7 Web Gateway Statistics The Web Gateway Statistics pane of the Dashboard shows an overview of Web Gateway activity in the set time period and provides a link to the related activity report. You can see the following: Malware Blocked: Shows the number of malware threats blocked. Phishing Blocked: Shows the number of phishing threats blocked. Websites Filtered: Shows the number of websites filtered (whether through category filtering or specific rules). Total Blocked: Shows the total number of block events across all devices. You can adjust the time period displayed by selecting D (Day), W (Week), or M (Month) in the lower right of the pane. 16

17 Help 5 Users & Devices The Users & Devices pages let you do tasks related to protecting your devices. 5.1 Users On this page, you can add or manage users, and get the users' computers or mobiles protected. You can enable the users to protect their own devices by ing them a setup link. The sections below tell you about the users list and also how to: Add users (page 17). Protect existing users (page 18). Modify users (page 19). Delete users (page 19). About the users list The current users are listed with details including: address. Deployment status. This shows whether the user has been sent a setup link and whether they have protected their devices yet. Exchange login. This is needed if you want mobile devices to synchronize Exchange information automatically. You configure this by specifying a policy for mobile devices. Security status. An icon shows whether the user has security alerts on any of their devices: Green if there are low-priority alerts or no alerts. Amber if there are medium-priority alerts. Red if there are critical alerts. Click on the user's name to see details of devices and to see which has an alert. To see full details for a user, click on the user's name. For more information, see User Details (page 19). To display different types of user, click the dropdown arrow on the filter above the list. To send or resend setup links to users, use the buttons in the upper right of the page. Add users You can add users in different ways: Add users at the Users page manually. 17

18 Sophos Cloud Import users from Active Directory. See how at the Users & Devices > Active Directory page. Download an installer and run it yourself (instead of letting users use the setup link). This adds the user automatically. See the Downloads page. This section tells you how to add and protect users at the Users page. Add and protect a user 1. Click the Add button. 2. In the Add New User dialog, enter the following settings: User name. Enter the name of the new user. Do not include a domain name. address. Enter the address of the new user. Exchange Login (optional). The Exchange login might be necessary if you want mobile devices to synchronize Exchange information automatically. You configure this by specifying a policy for mobile devices. Add to groups (optional). Select one of the available user groups. Tip: You can start typing a name in the search box to filter the displayed groups. setup link. Select this if you want to send the user an with links that enable them to protect their own devices. If your license includes more than one type of protection, select those the user needs, for example Computers and Mobiles). Note: The user needs administrative privileges and internet access in order to protect their computer. Note: Web Gateway provides more advanced web security for computers than the standard protection. You can install it alongside the standard protection or on its own. 3. Click Save or Save & Add Another. The new user is added to the user list. When the user downloads and installs the software, their device is automatically associated with the user. Protect existing users To users you have already added to the list or imported: 1. Look at the list of users. For each user, the list shows whether an has been sent or not. 2. Select the user or users you want to protect. Click setup link. 3. In the setup link dialog, you are prompted to select the types of protection the user needs (if your license includes more than one). Note: The user needs administrative privileges and internet access in order to protect their computer. Note: If you see an Enable ios button, you need to create an Apple Push Certificate so that Sophos Cloud can manage ios devices. Click the button to start. Note: Web Gateway provides more advanced web security for computers than the standard protection. You can install it alongside the standard protection or on its own. 18

19 Help Modify users To modify a user's account, click the user's name to open and edit their user details. For more information, see User Details (page 19). Delete users To delete a user or users, select the checkbox next to each user you want to delete. Click the Delete button. Logins assigned to a deleted user can afterwards be assigned to another user.you can edit logins by using the Modify logins link on a user's details page. Note: Deleting a user does not delete devices associated with that user or remove the Cloud software from these devices. Note: Under some circumstances, the user may be recreated automatically in future: If the user logs in to an associated device that is still managed by Sophos Cloud, they will be added as a user again. If the user was added from Active Directory and is still in Active Directory, they will be added as a user again the next time that Sophos Cloud synchronizes with Active Directory User Details On this page, you can see and manage a user's full details, including: Security status. Account details. You can modify or delete accounts here. Events (such as blocked websites or non-compliance with policies) detected on the user's devices. Devices associated with the user. Policies applied to the user. Note: If a user has been imported from Active Directory, you cannot change the account details. However, you can add the user to a new Sophos Cloud group or add another login. Security status In the left-hand pane, an icon shows you whether the user has security alerts on any of their devices: Green if there are low-priority alerts or no alerts. Amber if there are medium-priority alerts. Red if there are critical alerts. You can see which devices have alerts in the Devices pane. 19

20 Sophos Cloud Account details In the left-hand pane, you can modify or delete the user's account. Modify the account 1. Edit the following settings: address. You cannot change this if the user was imported from Active Directory. Exchange Login. The Exchange login might be necessary if you want mobile devices to synchronize Exchange information automatically. You configure this by specifying a policy for mobile devices. Member of x groups.to change the group or groups the user belongs to, click Modify groups and select or deselect the groups you want. Associated with x logins. To change the login assigned to the user, click Modify logins. You can assign multiple logins to a user. Logins are only available when you removed the login from another user or deleted the user. 2. Click Save. Delete the account To delete the account, click Delete in the upper right of the page. Logins assigned to this user can afterward be assigned to another user. Events This displays events (such as blocked websites or policy non-compliance) detected on the user's devices. Devices This lists devices associated with the user. The list shows the device type and operating system, as well as the following details: Last Active. The time of the last synchronization. Overall Status. Whether there are security alerts on the device. Click on the device name for details. Action. Actions you can take. These depend on the device type. For more information, see Device Details (page 22). Policies This lists the policies that are applied to the user. The icons beside a policy indicate the security settings (such as malware protection or mobile control) included in the policy. Note: A gray icon indicates that this part of the policy does not apply to the user. This happens if a higher-priority policy with settings for the same feature is applied to the user. You can view and edit policy details by clicking the policy in the list. 20

21 Help 5.2 Groups On this page, you can manage groups of users. You can use groups to assign a policy to multiple users at once. Groups can be added, modified and deleted. Deleting a group will not delete its users. The current groups are listed and the number of users in each group is shown. To see full details for a group, click on the group's name. This opens the group details. For more information, see Group Details (page 21). Add a group 1. Click the Add button. 2. In the Add New Group dialog, enter the following settings: Group name. Enter the name of the new group. Members. Select users from the list of available users. Tip: In the Members box you can start typing a name to filter down the displayed entries. 3. Click Save or, if you want to create another group, Save and Add Another. Modify or delete a group To modify or delete a group, click the group's name to open and edit the group details. For more information, see Group Details (page 21) Group Details On this page, you can see and manage a group s details. The page displays the group name and the group s members. You can: Add or remove members. Delete the group. Add or remove members To add or remove members: 1. Click Modify users. 2. In the Modify users pop-up, use the arrows to select users from the Available list or deselect them. Click Done. 3. On the group details page, click Save. 21

22 Sophos Cloud Delete the group To delete the group: Click Delete in the upper right of the page. In the Delete Confirmation pop-up, click Confirm. Deleting a group will not delete its users. 5.3 Devices On this page, you can manage your protected devices. They will appear automatically after the Sophos Cloud agent software has been installed. The devices are listed with details of the operating system, users associated with the device, and the security and compliance status of the device. The security status is indicated by an icon, as follows: Green if there are low-priority alerts or no alerts. Amber if there are medium-priority alerts. Red if there are critical alerts. To search for a device, enter the name in the search field above the list. To display different types of device, click the dropdown arrow on the Show filter above the list. You can click on the entry for a device to see more details, to take action against the alerts, or to update, scan or delete the device Device Details On this page, you can see and manage details of a user device. The page includes: A status icon on the left. This indicates whether there are security alerts on the device: Green if there are low-priority alerts or no alerts. Amber if there are medium-priority alerts. Red if there are critical alerts. Click "View Warnings" (or "View Status") to see details. Actions buttons in the upper right of the page. Tabbed pages for Summary, Events and Status. The actions buttons and the information on the tabbed pages depend on whether the device is a computer or a mobile device. For more details, follow the links below. Computers (page 23) Mobile devices (page 24) 22

23 Help Computer details In the device details page for a computer, you see the following. Summary The Summary tabbed page displays details of the operating system, last user, last Sophos Cloud activity, last Sophos Web Gateway activity (if applicable), and last update of Sophos agent software. Status The Status tabbed page displays the device's security status and details of any alerts. It also lets you take action against alerts. Alerts The page lists any alerts on the device. The details include: Alert details: For example, the name of the malware. Date: This shows when the alert occurred. Actions: This shows the actions that you can take. These depend on the type of threat or event and are the same as the actions available in the Dashboard. See Action Center (page 7). Computer Security Status Note: These status details are only shown if the computer is using the Security Heartbeat feature. The computer security status is reported by computers running Windows 7 and later. This shows whether the device has threats detected, has out-of-date software, is not compliant with policy, or is not properly protected. The overall status is the same as that for the highest-priority item listed (red, amber or green). Activity This shows whether the device is active or not and gives details of past activity. Events The Events tabbed page displays events (such as blocked websites or policy non-compliance) detected on the device. Action buttons The action buttons in the upper right of the page provide these actions: Update Now: Updates the Sophos Cloud software on the computer. Scan Now: Scans the computer immediately. Note: The scan may take some time.when complete, you can see a "Scan 'Scan my computer' completed" event and any successful cleanup events on the Reports > Events page. You can see alerts about unsuccessful cleanup in the Action Center. 23

24 Sophos Cloud If the computer is offline, it will be scanned when it is back online. If a computer scan is already running, the new scan request will be ignored and the earlier scan will carry on. Delete: Deletes the computer from the Sophos Cloud console. This does not uninstall the Sophos Cloud agent software, but the computer will not synchronize anymore. Note: If you deleted the computer accidentally, re-install the Sophos Cloud agent software to get it back Mobile device details In the device details page for a mobile device, you see the following. The Status Icon The status icon on the left shows the overall status of the device, which is a combination of the security status and compliance status of the device. Summary The Summary tabbed page displays the following details: Name: A name for the mobile device, as shown in the Sophos Cloud console. Last Active: The time of the last check-in or synchronization that was performed. Device Management: The status of the mobile device management (Managed, Unmanaged, or Decommissioned). For more information, see Mobiles (page 71). Device Model: Information about what kind of device it is. Operating System: Operating system the device is running. IMEI / MEID / Device ID: This shows the device s unique identifier, if it can be retrieved from the device. If the device runs on a GSM network, the IMEI is displayed. If the device runs on a CDMA network, the MEID is displayed. Whether the device identifier can be retrieved depends on the device model and mobile network operator. If the device identifier cannot be retrieved, n/a is displayed. Telephone Number: This shows the device s telephone number, if it can be retrieved from the device. Whether the phone number can be retrieved depends on the device model and manufacturer. Jailbreak / Rooting Status: This shows the jailbreak status ( jailbroken or not jailbroken ) for ios devices and the rooting status ( rooted or not rooted ) for Android devices. Location: Displays the device s location, or shows if location is not currently available or locating the device is not allowed by the user. (See also the Locate action description further in this topic.) User: The user the mobile device belongs to. There is only one user for a mobile device. Enrollment Date: The time of the first synchronization after installation and configuration of the Sophos Mobile Control app. 24

25 Help For Android devices, the following additional information may be shown: Device Security: The status of the mobile security on the device (Managed, Unmanaged, or Decommissioned). Last Threat Data Update: The last time the Sophos Mobile Security app successfully updated its threat data. Last Scan: The last time the Sophos Mobile Security app scanned the device. Samsung SAFE Support: Indicates if the device supports Samsung SAFEv2+ features, which are available on selected Samsung devices. Samsung SAFE Availability: Shows if the Samsung SAFEv2+ features can be managed by Sophos Cloud on this device. Samsung SAFE Version: The version number of Samsung SAFE on Samsung SAFEv2+ devices. Unlock Password: A temporary password generated when the device is unlocked. (See the Unlock action later in this topic.) Events The Events tabbed page displays all events created for the device. Status This tabbed page displays the following information: Alerts: All alerts associated with this device are listed. These might be alerts created when malware, potentially unwanted apps (PUAs) or low reputation apps are detected on the device. (The latter two alerts are displayed if you have enabled PUA and low reputation app detection in the policy). It also lets you take action against alerts. Available actions depend on the type of event and are the same as the actions available in the Dashboard. See Action Center (page 7). Mobile Security Status: All security violations for this device are listed. See the list below. Mobile Compliance Status: All compliance violations are listed. Note: Compliance violations are reported only if the mobile device is managed by the Sophos Cloud Mobile Device Management (MDM). Device Active: This indicates if the device has recently synced with Sophos Cloud. Note: Android does not allow Sophos Mobile Security to uninstall apps automatically, without the user s involvement. Therefore, automatic cleanup of detected threats or questionable apps is not available. You can send a text message to the device asking the user to uninstall the app (see Action buttons (page 26)). The following security violations are reported: The device is jailbroken or rooted. Sophos Mobile Security threat data is outdated. Malware apps are detected. Suspicious apps are detected. 25

26 Sophos Cloud Potentially Unwanted Applications (PUA) are detected. Compliance Status This tabbed page shows whether the device is compliant or not. It also lets you take action against alerts. Available actions depend on the type of event and are the same as the actions available in the Dashboard. See Action Center (page 7). The reasons for non-compliance can be as follows, depending on the device s OS. The device is not managed. The device has to synchronize. The client software version is too old. The OS version is too old. The OS version is too new. No passcode is present. The device is jailbroken or rooted. The Sophos Mobile Control app has to synchronize. Locating the device is not allowed. Installation from non-market sources is enabled. Encryption is not active. Android debug bridge (ADB) is enabled. The device s mobile security status is amber or red. Action buttons The action buttons in the upper right of the page provide these actions: Wipe: Reset the mobile device to its factory settings. This involves the deletion of all user data, which is desirable if the device has been lost or stolen. The Sophos Cloud software is deleted as well, therefore the device will no longer be managed afterwards. However, it will remain in the list with the management status wiped, so that you get feedback that the wipe was successful. You can safely delete the device afterwards. Unlock: Unlocking a device removes the existing password protection on a device so that the user can set a new password. Unlocking works differently on ios and Android: On ios devices, unlocking immediately unlocks the device and prompts the user to set a new password. Therefore it is necessary to notify the user in advance (for example, via a phone call), as the device will remain unprotected until a new password is set. On Android devices, unlocking requires a password to be entered on the device. A password is automatically generated and sent to the user via . The user is requested to unlock the device using that password and set a new one immediately. Force Check-in: A check-in synchronizes the mobile device with Sophos Cloud. The device and the Sophos Cloud app have to be active. For more information on check-in and sync, see Configure Compliance Rules (page 40) 26

27 Help Lock: Enable the lock screen. The user will need the password that was set for the device in order to be able to use the device again. If no password was set, the lock screen will be enabled, but no password will be necessary. Save: Saves changes in the mobile device properties (the name). Locate: Locates the device and lets you view the location in Google Maps. For this feature to work, the user must have "Locate" allowed on the device (you can use a compliance rule (page 40) to ensure this). It can take up to 10 minutes for the most accurate location of this device to be found. If, after 10 minutes, the device has not been located, it is possible that it is off-line or has no power. Delete: Removes the device from Sophos Cloud management. This also deletes the Sophos Cloud configuration and all associated corporate data from the device (a corporate wipe ), but leaves personal data untouched. The Sophos Mobile Control app is not deleted. In order to get the mobile device back under Sophos Cloud management, the app has to be configured again as described in the deployment sent to the user (for details of how to send the , see Users (page 17)) Scan Now: Scans the device immediately. This action is available only for Android devices that have the Sophos Mobile Security app installed. If the device is offline, it will be scanned when it is back online. The scan may take some time. When complete, you can see any events resulting from the scan on the Reports > Events page, and alerts about malware, PUAs or low reputation apps in the Action Center. Send Message: Allows you to send a text message to the device. 5.4 User Policies User policies define the security measures that will be used for your users' devices. Note: Different policies apply to servers. For those policies, see Server Policies (page 54) instead. On the user Policies page, you can view, add, edit and test policies. The sections below tell you how policies work and also how to: View a policy (page 30). Add a policy (page 31). Edit a policy (page 32). How policies work This section tells you how Sophos Cloud policies work. What is the Base Policy? The Base Policy is the default policy and is always available. This policy has been set up for you and is already configured with the Sophos best practice settings. It applies to all the users initially. You can edit the settings in the Base Policy. However, you cannot disable or delete it, even if you create other policies. Tip: If you made any changes in the Base Policy and want to revert it to its original state, click the Reset button. 27

28 Sophos Cloud Do I need any other policies? If you wish, you can use only the Base Policy. You do not have to create any others. You can even use the Base Policy without changing any settings -- unless you want to enable optional features. However, you can use additional policies if you want to. What are additional policies? Additional policies are policies that you create. You can use them to apply different settings to different users or groups, or to make it easier to switch the settings applied to users or groups quickly. Your additional policies can override some or all of the settings in the Base Policy. Additional Policies can be disabled, and, optionally, be set to expire after a certain point in time. You can clone any policy so that you can quickly create a variation based on it. The order in which you put the policies on the page matters, as this decides the priority given to a policy. See How do you use additional policies?" below. What is in each policy? A policy can include settings for all the security features that you have licensed, or for just some features, or for a single feature. Tip: Features are represented by icons shown in the same line as the policy name. Hover over them for information. For some features, such as malware protection, a policy contains all the settings for that feature. You cannot split up the malware protection settings across several different policies in such a way that a user gets one setting from one policy and another setting from a different policy. For other features, such as mobile control, there are sub-features, such as Exchange settings or Wi-Fi settings, that are treated separately. So a user can get their Exchange settings from one policy and their Wi-Fi settings from another. Note: You can have more than one policy that configures malware protection, but only one of those policies applies to a particular user. And that one policy determines all the settings for that user. How do you use additional policies? You can use an additional policy to apply different settings for all the security features, or just for selected features. The order in which you arrange the policies (the order shown on the Policies page) determines which settings are applied for each security feature. To determine the policy to apply for a given user, Sophos Cloud looks through the policies from the top down.the first policy that is assigned to that user and that includes settings for a particular feature (such as malware protection), will be applied for this feature. However, the settings for another feature might be taken from another policy. Sophos Cloud will search again for the highest policy that is assigned to that user and includes the feature in question. The Base Policy is always at the bottom, and therefore applied last. You should place the most specific policies at the top and more general policies further down. Otherwise, a general policy might apply to a device for which you wanted a individual policy. 28