The CHALLENGE of DETECTING and REMOVING Sophos Form

Instructions and help about THE CHALLENGE OF DETECTING AND REMOVING Sophos

Device isolation can create some challenges for how the device can be accessed for diagnostic equipment and diagnostic routines. Sophos Intercept X advanced includes an exclusion policy to identify the IP addresses and ports that are allowed to talk to an otherwise isolated device. So when an administrator moves a device into an isolation state, its connections to the network have been broken. The default is that it's only allowed to communicate to Sophos labs and Sophos Central where the administrator is performing diagnostics, or to connect to critical infrastructures so that if the machine is rebooted, it can still get an IP address and connect to the network. Often in accounts that are performing device forensics, they need to identify other applications and computers that are allowed to talk to that device. This can be done through adding a computer isolation exclusion in Sophos Central. You can see that directly from the global settings, exclusions. Going to global exclusions we