MTR cases

You can track the MTR cases that we raise and investigate for you.

To see the MTR cases, go to MTR > Cases.

The page lists all the cases we've raised in the time period you select and shows a description of each case and its status.

MTR cases page

Status

  • In progress: We're still analyzing the data.
  • Action required: You need to take action. (We've notified your contacts.)
  • Resolved: We've resolved the threat.

The statistics panels above the list show the number of cases with each status for the current time period and the percentage change since the last time period.

By default, you see statistics for the past 7 days. To change this, click the menu in the upper right of the page.

Severity

The list also shows the severity of each incident:

  • Level 1 (red)
  • Levels 2 or 3 (yellow)
  • Levels 4 or 5 (green)

Cases are opened for possible threats with high severity (level 1). However, we can change the severity after analysis.

Case details and messages

You can view case details or exchange messages with the Sophos MTR team about the case.

  1. Click the case number in the ID column.
    Screenshot of MTR case ID
  2. On the Case Details page, Overview shows the threat type and the progress of the case.
    MTR case details
  3. On the Case Details page, you can also see messages about the case from the Sophos MTR team. To reply, type your reply in New message and click Send message.
    • Messages that you send go into an MTR inbox. We'll respond to them later.
    • Messages that you send or receive are copied to your authorized contacts' mailboxes, so you won't miss any messages.
    • You can send and receive attachments as well as messages.
    MTR case messages