Hello Samson, I'm not Sophos, so all this is from my personal knowledge and view. For the scan-on-insert functionality (I've already outlined the intricacies in my previous post) feature requests have been posted. As said, IMO it'd be only practical for dedicated sheep-dips. You already get SD cards with 512GB, scanning of the internal (often not more than 1TB) drive should take place during off-hours for performance reasons but then a removable device should be fully scanned upon insert - this doesn't fit. Having said that, the management server is not designed as log collector. Even the endpoint does not record the source of an alert/event in its consolidated log (SAV.txt) although it records the summary and cancel/abort events. It's probably more work than just adding one or the other table and a few columns. The information just isn't there right now and with the focus currently on real-time, live, Cloud, you name it I don't think that such a feature would get top priority. Just my 2 cents though. Christian
↧