Managed Threat Response preferences

Set or edit Managed Threat Response preferences for your managed customers.

Managed Threat Response (MTR) is a service that warns you about threats and helps you resolve them.

To use MTR, you must set MTR preferences. By default, these apply to all your managed customers.

You can customize your preferences for specific customers if you want to.

Set MTR preferences

Set or edit MTR preferences for your customers as follows:

  1. Go to Settings & Policies.
  2. Under Partner account settings, click Managed Threat Response Preferences.
    Settings & Policies page
  3. On the Authorized Contacts> tab, enter contact details for admins who will get MTR notifications and work with the MTR team. If there's an active threat, we'll contact each of them in turn until we get a response.
    1. In the Primary drop-down menu, select one of the Sophos Central Partner admins.
    2. Enter the admin's contact details.
    3. Optional Enter Secondary and Tertiary contacts.

    You must enter at least a Primary contact.

    Authorized Contacts tab
  4. Click the Threat response tab and choose how you want us to respond to active threats.
    • Notify. We'll notify your contacts about the threat and send them any details they need to resolve it.
    • Collaborate. We'll work with your contacts to resolve the threat. If we can't reach the contacts, we'll take action.
    • Authorize. We'll take any action needed to resolve the threat, and we'll notify your contacts.

    The default is Notify.

    Threat response tab

If you're setting up MTR for the first time, you must ensure that the Sophos MTR agent (which is included in the endpoint protection installer) is installed on customers' computers. See Deployment.

Customize preferences

You can set custom MTR preferences for specific customers.
  1. Go to Settings & Policies > Managed Threat Response Preferences.
  2. Click the Customize preferences tab and do as follows:
    1. Select a customer.
    2. In the Customize column, change the setting to Yes.
    3. In the Control column, click Configure.

    This opens the customer's MTR preferences in Sophos Central Admin so that you can edit them.


    Customize preferences tab
  3. Enter your settings in the customer's Authorized Contacts and Threat response tabs.