Skip to content
Last update: 2022-05-10

MTR settings

Configure or edit your Managed Threat Response (MTR) settings, including your contacts and service level.

The first time you sign in to Sophos Central after you activate an MTR license, you’re prompted to enter settings needed for the MTR service.

You can also enter or change your settings at any time, as follows:

  1. Go to MTR > MTR Settings.
  2. In Authorized Contacts, you’re asked for contacts in your organization. They must be Sophos Central admins. If there’s an active threat, we’ll contact each in turn until there's a response.

    1. If you need to create a new Sophos Central admin, click Create new Central administrator and add a user with the Super Admin, Admin, or Help Desk role.
    2. Click the drop-down arrow beside Primary and select one of your Sophos Central admins. Enter their contact details.
    3. Select Secondary and Tertiary contacts, if you want to, and enter their details. We recommend that you have multiple contacts.

    If you use a Sophos Central admin with an email address that's a distribution list, multiple users can use the admin account. To limit what they do, select the Help Desk role because it has the lowest privileges.

    Screenshot of authorized contacts settings

  3. Click the Threat response tab.

  4. In Industry Vertical, select your specialised market, if applicable.

    This helps us target our threat hunting.

    Industry verticals are groups of companies that focus on a specialised market spanning multiple industries. For example Fintech or digital health.

    Industry vertical

  5. In Threat response mode, choose how you want us to respond to active threats.

    If you have a Sophos MTD license, you can't change this setting.

    Select one of the following:

    • Notify. We'll notify you about the threat and send you any details you need to resolve it yourself. This is the default.
    • Collaborate. We'll work with your contacts to resolve the threat. If we can't reach the contacts, we'll take action.
    • Authorize. We'll take any action needed to resolve the threat, and we'll notify you.

    Screenshot of threat response settings

  6. If you don’t already have the Sophos MTR software on each of your computers or servers, install it on them.

    • If you already have other Sophos endpoint software, see the instructions in the Sophos MTR startup guide for existing customers.
    • If you're new to Sophos, download the Sophos MTR (or Sophos MTD) software from the Protect Devices page and install it.
Back to top