Set up the Sophos MTR service

Follow these instructions to set up the service.

1. Go to https://central.sophos.com and sign in with administrator rights. You see a form like this:

   
   
   

2. In Authorized Contacts, you set up contacts in your organization. They must be Sophos Central admins.
   • Click Create new Central administrator if you need to create admins.
   • If you already have Sophos Central admins, skip to step 4.

   
   
   

3. In the Add User page, do as follows:
   1. Enter a user's name and email address.
   2. In Role, select Super Admin, Admin, or Help Desk.
   3. Assign the user to a group.

   If you're going to use an email address that contacts a ticketing system, give its admin account the Help Desk role because this has the lowest privileges.

   
   
   

4. In the Managed Threat Response Preferences page, enter the details of your contacts. If there’s an incident, we’ll contact each in turn till there's a response.
   1. Click the drop-down arrow beside Primary and select one of your Sophos Central admins.
   2. Select Secondary and Tertiary contacts, if you want to (Recommended).

   
   
   

5. In Threat response mode, choose how you want us to respond to incidents. The default is Notify.
   • Notify. We'll notify you about the incident and send you any details you need to resolve it yourself.
   • Collaborate. We'll work with your contacts to resolve the incident. If we can't reach the contacts, we'll take action.
   • Authorize. We'll take any action needed to resolve the incident, and we'll notify you.

   
   
   

6. Click Save.