Transcription
Sophos Enterprise ConsoleHelpProduct version: 5.2.1, 5.2.2Document date: September 2014
Contents1 About Enterprise Console.62 Guide to the Enterprise Console interface.72.1 User interface layout.72.2 Toolbar buttons.82.3 Dashboard panels.102.4 Security status icons.112.5 Navigating the Endpoints view.122.6 Computer list icons.132.7 Filter computers by the name of a detected item.152.8 Find a computer in Enterprise Console.152.9 Navigating the Update managers view.163 Getting started with Sophos Enterprise Console.184 Setting up Enterprise Console.204.1 Managing roles and sub-estates.204.2 Creating and using groups.314.3 Creating and using policies.344.4 Discovering computers on the network.404.5 Synchronizing with Active Directory.434.6 Configuring the Sophos Mobile Control URL.495 Protecting computers.505.1 About protecting computers.505.2 Prepare for installation of anti-virus software.505.3 Prepare for installation of encryption software .505.4 Remove third-party security software.515.5 Protect computers automatically.525.6 Install encryption software automatically.535.7 Locate installers for protecting computers manually .555.8 Checking whether your network is protected.555.9 Dealing with alerts and errors.595.10 Scanning and cleaning up computers now.626 Updating computers.646.1 Configuring the update manager.642
6.2 Configuring software subscriptions.726.3 Configuring the updating policy.766.4 Monitoring the update manager.836.5 Update out-of-date computers.847 Configuring policies.867.1 Configuring the anti-virus and HIPS policy.867.2 Configuring the firewall policy.1157.3 Configuring the application control policy.1427.4 Configuring the data control policy.1447.5 Configuring the device control policy.1597.6 Configuring the full disk encryption policy.1667.7 Configuring the tamper protection policy.1737.8 Configuring the patch policy.1757.9 Configuring the web control policy.1778 Setting up alerts and messages.1868.1 About alerts and messages.1868.2 Set up software subscription alerts.1868.3 Set up anti-virus and HIPS email alerts.1878.4 Set up anti-virus and HIPS SNMP messaging.1888.5 Configure anti-virus and HIPS desktop messaging.1898.6 Set up application control alerts and messages.1898.7 Set up data control alerts and messages.1908.8 Set up device control alerts and messages.1918.9 Set up network status email alerts.1928.10 Set up Active Directory synchronization email alerts.1938.11 Configure Windows event logging.1938.12 Turn sending feedback to Sophos on or off.1949 Viewing events.1959.1 About events.1959.2 View application control events.1959.3 View data control events.1969.4 View device control events.1969.5 View firewall events.1979.6 View encryption events.1979.7 View tamper protection events.1989.8 Viewing patch assessment events.1993
9.9 Viewing web events.2029.10 Export the list of events to a file.20410 Generating reports.20510.1 About reports.20510.2 Create a new report.20510.3 Configure the Alert and event history report.20610.4 Configure the Alert summary report.20710.5 Configure the Alerts and events by item name report.20710.6 Configure the Alerts and events by time report.20810.7 Configure the Alerts and events per location report.20910.8 Configure the Endpoint policy non-compliance report.21010.9 Configure the Events by user report.21110.10 Configure the Managed endpoint protection report.21110.11 Updating hierarchy report.21210.12 Schedule a report.21210.13 Run a report.21210.14 View a report as a table or chart.21310.15 Print a report.21310.16 Export a report to a file.21310.17 Change the report layout.21411 Auditing.21511.1 About auditing.21511.2 Enable or disable auditing.21612 Recovering access to encrypted computers.21712.1 Recover access with Challenge/Response .21712.2 Recover access with Local Self Help.21813 Copying or printing data from Enterprise Console.21913.1 Copy data from the computer list.21913.2 Print data from the computer list.21913.3 Copy computer details for a computer.21913.4 Print computer details for a computer.22014 Troubleshooting.22114.1 Computers are not running on-access scanning.22114.2 The firewall is disabled.22114.3 The firewall is not installed.22114.4 Computers have outstanding alerts.2224
14.5 Computers are not managed by the console.22214.6 Cannot protect computers in the Unassigned group.22314.7 Sophos Endpoint Security and Control installation failed.22314.8 Computers are not updated.22314.9 Anti-virus settings do not take effect on Macs.22314.10 Anti-virus settings do not take effect on Linux or UNIX.22314.11 Linux or UNIX computer does not comply with policy.22414.12 New scan appears unexpectedly on a Windows computer .22414.13 Connectivity and timeout problems.22414.14 Adware and PUAs are not detected.22414.15 Partially detected item.22414.16 Frequent alerts about potentially unwanted applications.22514.17 Cleanup failed.22514.18 Recover from virus side-effects.22614.19 Recover from application side-effects.22614.20 Data control does not detect files uploaded via embedded browsers.22714.21 Data control does not scan uploaded or attached files.22714.22 Uninstalled update manager is displayed in the console.22715 Glossary.22816 Technical support.23417 Legal notices.2355
Sophos Enterprise Console1 About Enterprise ConsoleSophos Enterprise Console is a single, automated console that manages and updates Sophossecurity software on computers running Windows, Mac OS X, Linux and UNIX operating systems.Enterprise Console enables you to do the following: Protect your network against viruses, Trojans, worms, spyware, malicious websites, andunknown threats, as well as adware and other potentially unwanted applications. Control which websites users can browse to, further protecting the network against malware,and preventing users from browsing to inappropriate websites. Control which applications can run on the network. Manage client firewall protection on endpoint computers. Assess computers for missing patches. Reduce accidental data loss, such as unintentional transfer of sensitive data, from endpointcomputers. Prevent users from using unauthorized external storage devices and wireless connectiontechnologies on endpoint computers. Prevent users from re-configuring, disabling, or uninstalling Sophos security software. Protect data on endpoint computers against unauthorized access with full disk encryption.Note: Some of the features above are not included with all licenses. If you want to use them,you might need to change your license. For more information, omparison.aspx.6
Help2 Guide to the Enterprise Console interface2.1 User interface layoutThe Enterprise Console user interface consists of the following areas:ToolbarThe toolbar contains shortcuts to the most common commands for using and configuring yourSophos security software.For more information, see Toolbar buttons (page 8).DashboardThe Dashboard provides an at-a-glance view of your network's security status.For more information, see Dashboard panels (page 10).Computer listThe computer list is displayed at the bottom right. It has two views: Endpoints view displays the computers in the group that is selected in the Groups pane atthe bottom left. For more information, see Navigating the Endpoints view (page 12). Update managers view displays the computers where Sophos Update Manager is installed.For more information, see Navigating the Update managers view (page 16).The screenshot below shows the computer list in the Endpoints view.7
Sophos Enterprise Console2.2 Toolbar buttonsThe following table describes the toolbar buttons. Some toolbar buttons are available only inspecific circumstances. For example, the Protect button to install anti-virus and firewall softwareis only available if a group of computers is selected in the Groups pane in the Endpoints view.Toolbar ButtonDescriptionDiscover computersSearches for computers on the network and adds them to the console.For more information, see Choose how to discover computers (page 40) andthe other topics in the Setting up Enterprise Console Finding computers onthe network section.Create groupCreates a new group for computers.For more information, see Create a group (page 32).View/Edit policyOpens the policy selected in the Policies pane for editing.For more information, see Edit a policy (page 38).8
HelpToolbar ButtonDescriptionProtectInstalls anti-virus and firewall software on the computers selected in the computerlist.For more information, see Protect computers automatically (page 52).EndpointsSwitches to the Endpoints view in the computer list.The Endpoints view displays the computers in the group that is selected in theGroups pane.For more information, see Navigating the Endpoints view (page 12).Update managersSwitches to the Update managers view in the computer list.The Update managers view displays computers where Sophos Update Manageris installed.For more information, see Navigating the Update managers view (page 16).ReportsStarts Report Manager so that you can generate reports about alerts and eventson your network.For more information, see About reports (page 205) and the other topics in theGenerating reports section.DashboardShows or hides the Dashboard.The Dashboard provides an at-a-glance view of your network's security status.For more information, see Dashboard panels (page 10).Sophos Mobile Control When the Sophos Mobile Control URL is configured, this opens the web consolefor Sophos Mobile Control, a device management solution for mobile devices(such as smartphones and tablets) that helps you to manage apps and securitysettings.For more information, see Configure the Sophos Mobile Control URL (page 49).9
Sophos Enterprise Console2.3 Dashboard panelsThe Dashboard contains the following panels:Dashboard PanelDescriptionComputersDisplays the total number of computers on the network and the number ofconnected, managed, unmanaged and encrypted computers.To view a list of managed, unmanaged, connected, encrypted, or all computers,click a link in the Computers area.UpdatesDisplays the status of update managers.Computers with alertsDisplays the number and percentage of managed computers with alerts about:Known and unknown viruses and spywareSuspicious behavior and filesAdware and other potentially unwanted applicationsTo view a list of managed computers with outstanding alerts, click the panel titleComputers with alerts.Computers over eventthresholdDisplays the number of computers with events over the threshold within the lastseven days.To view a list of computers with device control, data control, controlledapplication, or firewall events, click a link in the Computers over eventthreshold panel.Note: Depending on your license, some of the event types may not be displayed.10
HelpDashboard PanelDescriptionPoliciesDisplays the number and percentage of managed computers with group policyviolations or policy comparison errors. It also includes computers that haven'tyet responded to the changed policy sent to them from the console.To view a list of managed computers that differ from policy, click the panel titlePolicies.ProtectionDisplays the number and percentage of managed and connected computerson which Sophos Endpoint Security and Control or Sophos Anti-Virus is out ofdate or uses unknown detection data.To view a list of managed connected out-of-date computers, click the panel titleProtection.ErrorsDisplays the number and percentage of managed computers with outstandingscanning, updating, or firewall errors.To view a list of managed computers with outstanding Sophos product errors,click the panel title Errors.2.4 Security status iconsThe following table describes the security status icons displayed in the Dashboard and theEnterprise Console status bar.Security status iconDescriptionNormalThe number of affected computers is below the warning level.WarningThe warning level has been exceeded.CriticalThe critical level has been exceeded.Dashboard panel health iconsA Dashboard panel health icon is displayed in the upper-right corner of a Dashboard panel. Itshows the status of the particular security area represented by the panel.11
Sophos Enterprise ConsoleA Dashboard panel health icon shows the status of a panel icon with the most severe status,that is: A panel health icon changes from Normal to Warning when a warning level is exceeded forat least one icon in the panel. A panel health icon changes from Warning to Critical when a critical level is exceeded for atleast one icon in the panel.The network health iconThe network health icon is displayed on the right side of the Enterprise Console status bar. Itshows the overall security status of your network.The network health icon shows the status of the Dashboard panel with the most severe status,that is: The network's overall health icon changes from Normal to Warning when a warning level isexceeded for at least one icon in the Dashboard. The network's overall health icon changes from Warning to Critical when a critical level isexceeded for at least one icon in the Dashboard.When you first install or upgrade Enterprise Console, the Dashboard uses the default warningand critical levels. To configure your own warning and critical levels, see Configure the Dashboard(page 56).You can also set up email alerts to be sent to your chosen recipients when a warning or criticallevel has been exceeded for a Dashboard panel. For instructions, see Set up network statusemail alerts (page 192).2.5 Navigating the Endpoints viewComputer listIn the Endpoints view, the computer list displays the endpoint computers in the group that isselected in the Groups pane.This view contains a number of tabs. The Status tab shows whether the computers are protectedby on-access scanning, whether they are compliant with their group policies, which features are12
Helpenabled, and whether the software is up to date. This tab also shows if there are any alerts. Theother tabs give more detailed information on each of these subjects.You can filter the computer list using the View filter. In the View drop-down list, select whichcomputers you want to see. For example, select Computers with potential problems to displaycomputers with problems.You can also filter the computer list by the name of a detected item such as malware, potentiallyunwanted application, or suspicious file. For more information, see Filter computers by the nameof a detected item (page 15).You can search for computers by computer name, computer description or IP address. For moreinformation, see Find a computer in Enterprise Console (page 15).For an explanation of the icons displayed in the computer list, see Computer list icons (page 13).You can copy or print data displayed in the computer list. For more information, see Copy datafrom the computer list (page 219) and the other topics in the section Copying or printing data fromEnterprise Console.Groups paneIn the Groups pane, you create groups and put networked computers in them. You can creategroups yourself or you can import Active Directory containers, with or without computers, and usethem as Enterprise Console computer groups.For more information, see What are groups for? (page 31) and the other topics in the Setting upEnterprise Console Creating and using groups section.The Unassigned groupis for computers that are not yet in a group that you created.Policies paneIn the Policies pane, you create and configure the policies applied to groups of computers. Formore information, see the following: About policies (page 34) and the other topics in the Setting up Enterprise Console Creatingand using policies section The Configuring policies section2.6 Computer list iconsAlertsIconExplanationA red warning sign displayed in the Alerts and errors column on the Status tabmeans that a virus, worm, Trojan, spyware, or suspicious behavior has been detected.13
Sophos Enterprise ConsoleIconExplanationA yellow warning sign displayed in the Alerts and errors column on the Status tabindicates one of the following problems:A suspicious file has been detected.An adware or other potentially unwanted application has been detected.An error has occurred.A yellow warning sign displayed in the Policy compliance column indicates that thecomputer is not using the same policy or policies as other computers in its group.If there are multiple alerts or errors on a computer, the icon of an alert that has the highest prioritywill be displayed in the Alerts and errors column. Alert types are listed below in descendingorder of priority.1.2.3.4.5.Virus and spyware alertsSuspicious behavior alertsSuspicious file alertsAdware and PUA alertsSoftware application errors (for example, installation errors)If several alerts with the same priority are received from the same computer, the most recent alertwill be displayed in the computer list.Protection disabled or out of dateA gray feature icon in the feature status column on the Status tab means that the feature isdisabled. For example, a gray shieldis inactive.A clock iconin the On-access column means that on-access scanningin the Up to date column means that the security software is out of date.Computer statusIconExplanationA computer sign with a green connector means that the computer is managed byEnterprise Console.A computer sign with a yellow hourglass means that installation of security softwareis pending.A computer sign with a yellow down arrow means that installation of security softwareis in progress.14
HelpIconExplanationA gray computer sign means that the computer is not managed by Enterprise Console.A computer sign with a red cross means that the computer that is usually managedby Enterprise Console is disconnected from the network. (Unmanaged disconnectedcomputers are not shown.)2.7 Filter computers by the name of a detected itemYou can filter the computer list by the name of a detected item such as malware, potentiallyunwanted application, or suspicious file. You can do so by configuring the filter "Managedcomputers affected by.". The filter is displayed in the View drop-down list along with the othercomputer list filters.To configure the filter:1. On the Tools menu, click Configure Filters.2. In the Configure Computer List Filter dialog box, enter the name of a detected item youwant to filter by. You can find the names of items detected on your network in: Computer list view, Alert and Error Details tab, Item detected column.Please note that if a computer has multiple detected items, the Item detected column willdisplay only the latest highest priority item, which may not be the one you filter by. Resolve alerts and errors dialog box. To open the dialog box, select a computer orcomputers in the computer list or a group of computers in the Groups pane, right-click andclick Resolve Alerts and Errors.Computer details dialog box. To open the dialog box, double-click the affected computer.Then scroll down to the Outstanding alerts and errors section.Reports (for example, Alert summary or Alerts and events by item name). To open theReport Manager, on the Tools menu, click Manage Reports.You can use wildcards. Use ? for any single character and * for any string of characters. Forexample, if you enter "Mal*" and then apply the filter, the computer list view will show computersinfected with malware whose name begins with "Mal", such as "Mal/Conficker-A" and"Mal/Packer".2.8 Find a computer in Enterprise ConsoleYou can search for a computer or computers in Enterprise Console by: Computer name Computer description15
Sophos Enterprise Console IP address1. To find a computer, do either of the following: Press CTRL F.On the Edit menu, click Find a Computer.Click anywhere in the computer list, right-click, and then click Find a Computer.2. In the Find dialog box, enter your search criteria.The Find what field is not case sensitive. Trailing wildcards are implicit.You can use the wildcards * and ?For example:Search criteriaSearch resultsUKlaptFinds any string beginning with “uklapt”, for example, UKlaptop-011,UKlaptop-155, uklaptop132.Ukla*Finds any string beginning with “ukla”. The wildcard is not needed as it isthere implicitly; search returns the same results as in the previous example,UKlaptop-011, UKlaptop-155, uklaptop132.*uklaFinds any string containing “ukla”, for example, UKlaptop-011, 055uklax,056-Dukla-sales.Ukl*tFinds any string beginning with “ukl”, containing a “t”, and ending with anycharacter, for example, UKlaptop-011, ukLite55.?klapFinds any string beginning with any single character followed by “klap” andending with any character, for example, UKlaptop-011, uklapland3
When the Sophos Mobile Control URL is configured, this opens the w eb console for Sophos Mobile Control, a device management solution for mobile devices Sophos Mobile Control (such as smar tphones and tab lets) that helps y ou to manage apps and secur ity settings. For more inf ormation, see Configure the Sophos Mobile Control URL (page 49). 9 Help
