This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Intercept X Advanced for Server and Sophos SafeGuard 8

Hello

I need a bit of guidance please.

I had "Central Server Protection Advanced" on our Servers with "Sophos SafeGuard 8" throughout the company. All working together perfectly.

I've enabled the new "Intercept X Advanced for Server" features in Sophos Central Server Protection. So I now have "Intercept X Advanced for Server" with SafeGuard.

If I try and encrypt 3 or more files using an endpoint to a server file share (using SafeGuard) Sophos Central reports a ransomware attack and blocks the endpoint from the network. I then have to log in to Central to Acknowledge all of the alerts to restore connectivity. The work around is to copy the files locally, encrypt them, and them copy them back to the server share folder... but this isn't ideal.

How do I get Intercept X Advanced for Server and SafeGuard to work together please??

Thank you

This thread was automatically locked due to age.

Parents

0 Barb@Sophos over 6 years ago

Hello SimonPerna,

Please have a look at these steps in order to get Safeguard to work with Intercept X

Regards,

Barb@Sophos
Community Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 S1P over 6 years ago in reply to Barb@Sophos

Hello

Thank you for your reply.

Our SafeGuard installation appears to be fully patched. The backend is at 8.00.2.16 and the clients are at 8.00.5.16.

Regards

Simon
Cancel
Vote Up 0 Vote Down

Cancel
0 Barb@Sophos over 6 years ago in reply to S1P

Hello SimonPerna,

Are you seeing any Cryptoguard events in the Windows Event Viewer (Event 911) ?
Also, what is the full message in Central?

If those 2 point to SafeGuard, and you are using the patched version, please submit a support case for further investigation

Also, please have a look at this article to create an exclusion and see if that allows you to workaround the problem in the meantime (do NOT add any exclusions unless you are sure you are dealing with a False Positive).

Regards,

Barb@Sophos
Community Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Barb@Sophos over 6 years ago in reply to S1P

Hello SimonPerna,

Are you seeing any Cryptoguard events in the Windows Event Viewer (Event 911) ?
Also, what is the full message in Central?

If those 2 point to SafeGuard, and you are using the patched version, please submit a support case for further investigation

Also, please have a look at this article to create an exclusion and see if that allows you to workaround the problem in the meantime (do NOT add any exclusions unless you are sure you are dealing with a False Positive).

Regards,

Barb@Sophos
Community Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 S1P over 6 years ago in reply to Barb@Sophos

Hello

Yes, I'm seeing cryptoguard events 911 and 300.

The full messages are:

Also, the event on the 26th was caused by saving a spreadsheet 3 times while I was working on it. May be 3 is the magic number :-)

I'll submit a support case.

Thank you for all of your time and help.
Cancel
Vote Up 0 Vote Down

Cancel
0 S1P over 6 years ago in reply to S1P

Case 8250879
Cancel
Vote Up 0 Vote Down

Cancel
0 Barb@Sophos over 6 years ago in reply to S1P

Hello SimonPerna,

Thank you for the ticket number. Please be sure to add your detections to the ticket (including the 911 events), as well as the SDU logs.

This will allow the technician to further investigate.

Please, let me know if you have any questions.

Regards,

Barb@Sophos
Community Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel