User behavior event types
These are the event types related to user behavior you can see in Sophos Central.
Depending on the features included in your license, you may see all or some of the following event types.
Web Control
| Event type | Severity | Action required? | Description |
|---|---|---|---|
| Web policy events | Low | No | Examine the appropriate reports for detailed information on how users are accessing sites, who is violating policy, and which users have downloaded malware. |
| Web threat events | Low | No | No |
Download Reputation
Sophos Central warns end users if a download has a low reputation. This reputation is based on a file's source, how often it is downloaded and other factors. See Download Reputation.
| Event type | Severity | Action required? | Description |
|---|---|---|---|
| User deleted low reputation download | Low | No | A user deleted a download after Sophos Central warned that it had a low reputation. |
| User trusted low reputation download | Low | No | A user trusted a download after Sophos Central warned that it had a low reputation. |
| Low reputation download automatically trusted | Low | No | Sophos Central detected a low reputation download and trusted it automatically. This occurs only if you change your reputation checking settings to "Log only". |
Data Loss Prevention
| Event type | Description |
|---|---|
| An "allow transfer on acceptance by user" action was taken | A file containing controlled information was transferred after a user acknowledged they were transferring the information. |
| An "allow file transfer" action was taken | A file containing controlled information was transferred. |
| A "block transfer" action was taken | A transfer of a file containing controlled information was blocked. |