Configuration options for Sophos

Sophos' heuristic for predicting what traffic should be blocked. As a result these events often have relatively low noise and should not be disabled.

This will monitor traffic and inform you only of unexpected traffic or traffic coming from unusual locations (e.g. countries on the Enabled Countries list).

Checks for internal addresses that are acting in a malicious manner (e.g. acting like a spambot).

Like most high confidence/low confidence event pairs, the low confidence detections introduce a large amount of noise and are not helpful in most situations

Firewall AV is the first chance to catch a virus entering your network. It is important to stay informed of this attack vector

This detects applications that are not often used in a business setting, or are harmful for productivity.

Because there is some variation in workplace norms and expectations, if you find you are getting many hits from applications that are permitted in your workplace, it is fine to disable this event type

Finds a variety of dangerous traffic such as known viruses

The low confidence detections are often incorrect and introduce too much noise to be useful in most situations. If you have a full-time security department to go through the results, enabling low-confidence detections may be worthwhile