Sandstorm not doing anything

Hey Pieter van Kampen 

Welcome to the Sophos Community,

Could you please confirm (using packet capture) if the firewall rule you configured to utilize Sandstorm, is being properly applied for your test download?

Are you able to observe any entries in your log viewer for Sandstorm?

Hi, when using https://www.sophos.com/en-us/lp/sandstorm-test.aspx I see nothing in the packet capture nor in the sandstorm log.

However, when using http://sophostest.com/ I see this in packet capture and the sandstorm log. So there is probably a policy exception preventing the check on sophos.com

In any case, the sandstorm is working!

Hi, when using https://www.sophos.com/en-us/lp/sandstorm-test.aspx I see nothing in the packet capture nor in the sandstorm log.

However, when using http://sophostest.com/ I see this in packet capture and the sandstorm log. So there is probably a policy exception preventing the check on sophos.com

In any case, the sandstorm is working!

I noticed that in order to use sandstorm on https sites (which is the majority), I needed to have https scanning on, which on turn requires some distribution of the self signed certificate. It would really be nice if you can create certificates with Lets Encrypt, then you would not need to deploy a Certificate Authority.

In any case, even with that Sandstorm does not react to the downloads on  https://www.sophos.com/en-us/lp/sandstorm-test.aspx

As it works on any other test document, also with https, I assume there is something wrong with the documents on that page.

There is an automatic, hidden exception that sophos.com does not have any HTTPS decryption.  That means it does not see the download.

This is a problem between the product and the marketing teams.  That webpage should not be used.