SophosLabs Analysis Report
This feature might not be available to all users yet.
The SophosLabs Analysis Report provides SophosLabs' verdicts for messages reported by users and admins as Reported threat or Reported clean. It also provides an overview of spam and bulk messages categorized by Sophos Email.
Go to Reports > Email Security > SophosLabs Analysis Report.
Filters
You can view messages received in the past 365 days. By default, messages for the last 30 days are shown. To filter the report data, select either Reported threat or Reported clean from the drop-down menu.
Ribbons
The ribbon at the top of the report has two parts:
- Sophos detected: Shows the number of messages identified as "Threat" or "Bulk" messages by Sophos during the initial scan.
- SophosLabs analyzed: Shows the number of messages categorized by SophosLabs after analysis as "Threat", "Bulk", "Uncategorized", or "Clean" messages.
"Malware", "Impersonation", and "Spam" messages are considered "Threats". You can hover over the individual parts of ribbons to see a breakdown of message categories.
Chart
The chart shows you a timeline view of messages that were submitted to SophosLabs for analysis.
You can hover over the chart to see the number of messages per category. You can hide categories by deselecting them in the legend to focus on the date you’re most interested in. To hide the chart, click Hide graph at the top right of the page.
Report Details
The report table shows the number of processed messages for each date within the selected range. You can sort the table by any column.
Each row represents a message that was submitted to SophosLabs for analysis.
The report shows the following details:
- Sender
- Reporter
- Subject: Click the subject to view more details about the message.
- Date: Shows the date and time when the message was received.
- Verdict: Indicates the SophosLabs verdict, such as "Malware", "Impersonation", "Spam", "Bulk", "Uncategorized", and "Clean". The messages have yet to be analyzed by SophosLabs and will show as "Analysis pending".
Click the three dots 
on the right of the report details to block the sender, domain, or IP address.
You can expand each row for additional details.
