This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Policy non-compliance: Exploit Detection

All,

I am newbie to Sophos. I am using Sophos central to manage all of my machines. We are 100% MAC deployment.

I have a machine that is giving me the following alert:Policy non-compliance: Exploit Detection. There have not been any changes made to any policies etc.

I read some documentation on Sophos knowledge base. I am still not understanding how to troubleshoot / resolve this issue. I was thinking could I just reinstall the sophos on the agent to resolve this. I do not want that to be my answer for every issue.

Any help would be greatly appreciated! I have other machines will similar issues I am trying to resolve.

Justin

This thread was automatically locked due to age.

0 SAJ over 5 years ago

Hi Justin,

Have you recently done any exclusion via Sophos central Exploit mitigation? Can you please check and confirm the devices were restarted after the alert? Are they up to date?

SAJ

Community Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 TripleJ over 5 years ago in reply to SAJ

Hello

I have not done any exclusions. I just recently joined the company, so I am starting to work on cleaning up alerts etc. So no changes have been made in Sophos central. The device is question is up to date.

I reached out to the user yesterday, the user rebooted before leaving for the day.
Cancel
Vote Up 0 Vote Down

Cancel
0 SAJ over 5 years ago in reply to TripleJ

May I know when was the last alert on Sophos central under events.

SAJ

Community Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 TripleJ over 5 years ago in reply to SAJ

There is an entry for today - 11am. The entry says update succeeded.
Cancel
Vote Up 0 Vote Down

Cancel
0 Shweta over 5 years ago in reply to TripleJ

Hi TripleJ

If you are still seeing the detection post-reboot of the machine, and there is nothing changed in the policy, we might need MCS trail logs to investigate this further as this might be the issue related to Endpoint communication. I would recommend you to open a support case along with those logs. Please PM me the case number once done.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel