Why 10 threat cases have been created for single malware in e-mail attachment

Hello Nikola Djurdjevic 

Please go through the article below for reference on Threat Cases:

Sophos Central: Threat Cases overview

Also the screenshots are a bit too small to see detail. Are these threat instances for a single device?

Hi DianneY,

thank you for your feedback. I will check the reference you gave me.

First 10 are for one device while the other 10 are for another device. The common for both is that they have received e-mail with malware in attachment. So, two users on two different machines receives two different e-mails with two different malwares. For each mail 10 threat cases have been created. If I would go trough each I would see that they point to same file. The interesting thing is that each case is created in timespan of 3 minutes. It is not possible that User have opened the same file 10 times in each 3 minutes.

Sorry for picture sizes. I have made a screenshot (big pictures) but somehow they are small on this question editor.

Kind regards,

Nikola

Hello Nikola Djurdjevic 

Does it also show the same detections in the Devce's Events tab in Central?

Thanks,

Hello Nikola Djurdjevic 

Does it also show the same detections in the Devce's Events tab in Central?

Thanks,

For each device in Events tab says that Malware is detected twice and than after deleted. So two event for detecting same malware and two events about deleting malware.

Check pictures below. I hope they will be visible.

Hello Nikola Djurdjevic 

SAV may have been detecting cached copies of the attachment or the email. Check the path that SAV is seeing (which may be some hidden INetCache location) and delete the file. While that might help with cleanup, I would suggest contacting the Support team for further assistance to see if there is something unusual with the Threat Cases being created.

Thanks,