Disable PUA automatic remove.

Hi Mat_,

We currently do have an option in the central console to set the action taken for the PUA detections. You may choose the action to authorize or block when Sophos client detects it.

You can also vote for the existing feature request.

Hi,

Yes I've already seen this option, this happend only with some PUAs.

Others PUAs gets cleaned-up automatically, without any action of myself ; see this screenshot :

So as I understand, there is no such options for disabling automatic remove of PUAs like this for malwares ?

Hi Mat_,

In these scenarios, You can create a folder exception(The application location) and exclude it from scanning. Also, add the application that is being detected as PUA under the exception.

Note: The above suggestion is only if you are 100% sure that the application is safe to use and as a temporary workaround. The best practice would be to submit the application to Sophos Labs and get it whitelisted.

Check community.sophos.com/.../11490How to submit a sample to Sophos Labs

Hi Gowtham Mani and thank you for your answer, but this doesn't really help me.

I'm currently migrating from another antivirus to Sophos.

What I want to do is disable malwares and PUAs auto remove during the migration, then whitelist some trusted software considered as PUAs or malwares by Sophos and then re-enable malwares and PUAs auto remove.

The problem is that Sophos will detect some software as PUAs that our old antivirus didn't detect, so I can't just use PUAs exceptions from our old antivirus.

So, does this option exists ?

Hi Mat_,

Currently, we do not have the option to configure the action taken for PUA's. You can raise a feature request here.

Sophos has forgotten that the P in PUA stands for potential. I've raised a feature request for this exact same problem. It can be voted on here:

https://ideas.sophos.com/forums/428821-sophos-central/suggestions/33649174-machine-learning-is-auto-cleaning-puas-and-not-sen

Two years later and this still isn't resolved. This is a serious PITA, as you don't know what gets recognized as PUA until it is removed.

We just started rolling out Endpoint Protection via Sophos Central and I already had two cases where this breaks running applications. And to put icing on the cake out of the box you don't get a notification, unless you notice the breakage or specifically look for it.

Is disabling Deep Learning a valid workaround?

Hi Marcus Bayer 

Disabling Deep learning is not a good idea.

If you have the case where PUA was detected and was removed, you can allow it as the exception and that same file will not be detected as PUA in future until software update happens and you have allowed the SHA for the exception.

Please refer to this article for what action you can take.

Hello Jasmin, while I understand where this is coming from, please also understand the annoyance that I rather like to review a PUA find than have to repair and whitelist something aftterwards. We are talking about PUA after all, not malware. Why do I have the possibility to disable malware cleanup, but not PUA cleanup?

Hi Marcus Bayer 

I certainly understand your concern, but this is something by design. If you believe a detection was made in error, then please submit to our labs for re-categorization: https://community.sophos.com/kb/en-us/134763