Set Managed Threat Response preferences

Managed Threat Response (MTR) is a service that warns you about threats and helps you to resolve them.

The first time you sign in to Sophos Central after you activate an MTR license, you’re prompted to set your MTR preferences.

You can also set or change your preferences at any time, as follows:

  1. Go to Global Settings > Managed Threat Response Preferences.

    Screenshot of Global Settings page

  2. In Authorized Contacts, you’re asked for contacts in your organization. They must be Sophos Central admins. If there’s an incident, we’ll contact each in turn until there's a response.
    1. If you need to create a new Sophos Central admin, click Create new Central administrator and add a user with the Super Admin, Admin, or Help Desk role.
    2. Click the drop-down arrow beside Primary and select one of your Sophos Central admins. Enter their contact details.
    3. Select Secondary and Tertiary contacts, if you want to, and enter their details. We recommend that you have multiple contacts.

    If you use a Sophos Central admin with an email address that's a distribution list, multiple users can use the admin account. To limit what they do, select the Help Desk role because it has the lowest privileges.

    Screenshot of authorized contacts settings

  3. In Threat response mode, choose how you want us to respond to incidents. The default is Notify.
    • Notify. We'll notify you about the incident and send you any details you need to resolve it yourself.
    • Collaborate. We'll work with your contacts to resolve the incident. If we can't reach the contacts, we'll take action.
    • Authorize. We'll take any action needed to resolve the incident, and we'll notify you.

    Screenshot of threat response settings

  4. If you don’t already have the Sophos MTR software on each of your computers or servers, install it on them.