Skip to content
Last update: 2022-03-17

Managed Threat Response preferences

Set or edit Managed Threat Response preferences for your sub-estates.

Managed Threat Response (MTR) is a service that warns you about threats and helps you resolve them.

To use MTR, you must set MTR preferences.

You can set MTR preferences for your sub-estates in Sophos Central Enterprise. We use these contacts as the default contacts for any new sub-estates.

If you have MTR contacts set up for a sub-estate in Sophos Central Admin, we don't override them with the contacts you set in Sophos Central Enterprise.

You can modify existing contacts for a sub-estate in Customize preferences.

Set MTR preferences

By default, your preferences apply to all your sub-estates.

You can customize your preferences for specific sub-estates if you want to.

To set or edit MTR preferences, do as follows:

  1. Go to Settings & Policies.

  2. Under Enterprise account settings, click Managed Threat Response Preferences.

    Settings & Policies page

  3. On the Authorized Contacts tab, enter contact details for admins who will get MTR notifications and work with the MTR team. If there's an active threat, we'll contact each of them in turn until we get a response.

    1. In the Primary drop-down menu, select an administrator.

      You can only choose an Enterprise Super Admin. We show you your available Enterprise Super Admins.

      You must have at least a Primary contact. We recommend that you create all three contacts in case the primary contact is unavailable when the MTR Ops team needs to contact you.

    2. Enter the admin's contact details.

    3. Enter Secondary and Tertiary contacts. If a sub-estate doesn't already have contacts assigned to it, the contacts you've set here become its MTR contacts.

    Authorized Contacts tab

  4. Click the Threat response tab and choose how you want us to respond to active threats.

    • Notify: We'll notify your contacts about the threat and send them any details they need to resolve it.

    • Collaborate: We'll work with your contacts to resolve the threat. If we can't reach the contacts, we'll take action.

    • Authorize: We'll take any action needed to resolve the threat, and we'll notify your contacts.

    The default is Notify.

    Threat response tab

  5. Click Save.

If you're setting up MTR for the first time, you must ensure that the Sophos MTR agent (which is included in the endpoint protection installer) is installed on the sub-estate's computers. See Deployment.

Customize preferences

You can set custom MTR preferences for specific sub-estates.

For example, you can do the following:

  • Choose different MTR contacts for different sub-estates. You can only select administrators assigned to that sub-estate. We show you the administrators assigned to your selected sub-estate.

  • Assign an Enterprise Super Admin that has Admin permissions for a specific sub-estate to that sub-estate

  • Assign a Sophos Central administrator to a sub-estate.

    To do this, in Customize preferences, select the sub-estate and click Define Central Admin.

To customize your preferences, do as follows:

  1. Go to Settings & Policies > Managed Threat Response Preferences.

  2. Click Customize preferences and do as follows:

    1. Select a sub-estate.

    2. Choose how you want to manage the preferences for the sub-estate.

      • Use configured settings: Click this to use the global preferences you set up under Managed Threat Response Preferences.

      • Set preferences from Enterprise level: Click this to set up specific preferences for this sub-estate. Enter your settings in the Authorized Contacts and Threat response tabs in Sophos Central Enterprise.

      • Set preferences from sub estate level: Click this to open the sub-estate's MTR preferences in Sophos Central Admin so that you can edit them. Enter your settings in the sub-estate's Authorized Contacts and Threat response tabs.

    Customize preferences tab

  3. Click Save.

Back to top