Intercept X - How to Report False Positives

This article details how to raise issues for potential false positives with Intercept X, along with the available workarounds,

Applies from the following Sophos product(s) and version(s)
Central Intercept X 11.5.0

What To Do

1. CryptoGuard Ransomware Protection
   
   
   1. Perform the following options:
      
      
      1. Reboot the computer
         • If the detection is valid it will trigger again. However, this initial reboot may resolve the issue.
      2. Do nothing, the application will continue to be blocked
      3. Turn off CryptoGuard ransomware protection in the policy to prevent the detection. (You may want to limit this to the affected computer/s).
         
         
   2. Open a support ticket and provide the following information:
      
      
      1. Information on the application triggering the detection.
      2. The output of the Sophos Diagnostic Utility.
         
         Note: This Utility can be launched from the Sophos Endpoint user interface. Click on About and then Run Diagnostic Tool.
         
         
2. Exploit Mitigation
   
   
   1. Perform the following options:
      
      
      1. Reboot the computer
         • If the detection is valid it will trigger again. However, this initial reboot may resolve the issue.
      2. Do nothing, the application will continue to be blocked
      3. Turn off Exploit Mitigation in the policy to prevent the detection. (You may want to limit this to the affected computer/s).
      4. Set an exclusion for the application under System Settings | Exploit Mitigation Exclusions.
         
         
   2. Open a support ticket and provide the following information:
      
      
      1. Information on the application triggering the detection.
      2. The output of the Sophos Diagnostic Utility.
         
         Note: This Utility can be launched from the Sophos Endpoint user interface. Click on About and then Run Diagnostic Tool.

Related information

• FAQ on Sophos Central Endpoint license changes

Article appears in the following topics

• Endpoint Security and Control
• Sophos Cloud
• Sophos Cloud > Endpoint protection