Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/partner/help/en-us/index.html?contextId=attack-details-report

Attack Details

Restrictions

This feature is only available for the following users:

  • Partner Admins and Partner Super Admins. These admins also need both computer and server access.
  • Customers with licenses that include Intercept X Advanced or XDR. MDR customers won't see it.

You can see the modal below when an attacker tries to access or attack your customers environment. It's only available if we're warning you about a serious attack.

Attack warning modal.

You can see the affected customers and the date when the attack was detected.

Take action

You can take action in the following ways:

  • Click Contact Sophos Incident Response. Contact us, and let us take action for you. You'll be asked to enter your contact details. This is a paid service.
  • Click Open customer account. This will take you to that customer's Sophos Central Admin account.
  • Click Close to dismiss the modal. You can still see the warnings on the Alerts page.

When all attacks are resolved, the modal will stop displaying.

Tip

We recommend you sign in to the customers' Sophos Central accounts to view more information about the attack.