Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos URL Sample Submission - still a black hole without communication

Hey Sophos Team,

2 Years ago I already asked you to review your URL Sample / Recategorization workflow.

I even wrote this on 19.11.2021 directly to the Sophos Customer Advocate responsible for Germany Region.

URL Sample Form: support.sophos.com/.../filesubmission

Nothing has changed since - if you submit a URL to change the category or to mark it as malware, you guys still not notify me about changes you eventually make to the URL category. Not only that this process usually takes days or weeks (!!) to complete, this is still a complete black box.

Even if you login the support portal with your company account. In the sample form you already know who I am, and write company name, name, mail address, and additionally ask for SN of the firewall. But you do noting useful with that information. Just collecting.

All of your competitors can do that better and I kindly ask to change that process on your support web portal and finally start

1) notify customer about URL sample submit input

2) notify customer about the further progress and changes done or not done to the URL category

It's really bad to file a classic support case for such a simple job because that is currently the only way to get me updated.



This thread was automatically locked due to age.
Parents
  • Hi

    Please allow us some time while we follow up with our team internally regarding this. 

  • Hi  , 

    I appreciate your patience! As suggested earlier, you can run the URL on Intelix, and if you're not satisfied with the categorization, you can disagree with it, which will later open a support ticket. You will be able to view and manage this ticket from your support portal. Please see "What if I do not agree with the results?" section of the following article - https://support.sophos.com/support/s/article/KB-000033301?language=en_US

    Please note: 

    • The Disagree option is only available for customers with validated Support Portal profiles.
    • There is a one-day limit for submitting a disagreement and for re-analysis.

  • Thank you  

    First I need to say it's a misleading topic of that KB Article - because reporting an URL is no file sample.

    Submit samples of suspicious files to Sophos
    KB-00003330119. Jan. 2023

    Could you please add the 2 words "and URL" to it?

    Then, after reading, I just found out, that intelix only creates a classic support case:

    After submission, the sample is sent to SophosLabs for further analysis, and a case is created under your account which can be monitored from the Support Portal.

    And there is no "Disagree" button here.

    Can you tell me what I'm doing with my " customers with validated Support Portal profiles." Support profile all day - I've had countless support cases open with it.

  • Thank you for sharing the screenshots,  ! 

    I've inquired internally about this and will post an update here once I hear back from our teams. In the meantime, I've got confirmation that the URL has been reclassified and the updated classification should reflect in an hour. 

  • There were some backend issues ("It seems like we're having multiple contact entries for your email address ") with my account and it's assignments internally at Sophos so the "disagree" button was not shown on intelix for me.

    helped to get this solved for me and is still on it for my colleagues.

    Now I can use intelix and creates a "classic" support case, if you disagree. It works and due to that case, I get feedback on what happens with the file / URL.

    In the meantime, there is now a new banner over the old submission form:

    and there is the link to KB-000033301 about how to use intelix (quite long but detailled)

    https://support.sophos.com/support/s/article/KB-000033301?language=en_US

      posted that link already above.

    I think you did a good progress with intelix and probably some day may retire the old submission form.

    Thanks to all involved here.

  • Can you please verify, the intelix URL submission disagreement is passing through the full URL to the support case?

    It looks like, it isn't:

    06442818 / Intelix Disagreement - URL - ...

    Support wrote: "It seems that the URL provided xxxxxxxxxxxxxxxxxxx

    invalid/incomplete kindly re-submit the URL  through Sophos Support File Submission on the link below.

    File Submission : https://support.sophos.com/support/s/filesubmission?language=en_US

    So they want me now to use the old form that provides no feedback.

  • Hi Lherzog,

    Regarding your case, I'm checking this with our Internal Team. Will keep you posted once I"ve got an update.

  • Hi LHerzog,

    We got an update from our internal team and below is what they advise

    We do plan to allow URL submissions via the intelixUI and then to be able to disagree and get a ticket etc., just as we do today for files. However, at the moment, URLs won't create a ticket in the same way as files. It’s still the old way.

    We’re also working with support to get the process in place for URLs. However, we don't have a tentative time as to when this will be rolled out/implemented.

  • Confused that is disappointing. file submission was always working with feedback when files have been analyzed. only URL submission was black holed.

    Now you tell us, intelix is the new tool with all the cool features - use it!

    and URL submission is not working....

Reply
  • Confused that is disappointing. file submission was always working with feedback when files have been analyzed. only URL submission was black holed.

    Now you tell us, intelix is the new tool with all the cool features - use it!

    and URL submission is not working....

Children
No Data