Managed Threat Response preferences
Set or edit Managed Threat Response preferences for your managed customers.
Managed Threat Response (MTR) is a service that warns you about threats and helps you resolve them.
To use MTR, you must set MTR preferences. By default, these apply to all your managed customers.
You can customize your preferences for specific customers if you want to.
Set MTR preferences
Set or edit MTR preferences for your customers as follows:
- Go to Settings & Policies.
Under Partner account settings, click Managed Threat Response Preferences.
On the Authorized Contacts tab, enter contact details for admins who will get MTR notifications and work with the MTR team. If there's an active threat, we'll contact each of them in turn until we get a response.
- In the Primary drop-down menu, select one of the Sophos Central Partner admins.
- Enter the admin's contact details.
- Enter Secondary and Tertiary contacts.
You must enter at least a Primary contact.
Click the Threat response tab.
In Industry Vertical, select the specialised market for your customer, if applicable.
This helps us target our threat hunting.
Industry verticals are groups of companies that focus on a specialised market spanning multiple industries. For example Fintech or digital health.
In Threat response mode, choose how you want us to respond to active threats.
- Notify. We'll notify your contacts about the threat and send them any details they need to resolve it.
- Collaborate. We'll work with your contacts to resolve the threat. If we can't reach the contacts, we'll take action.
- Authorize. We'll take any action needed to resolve the threat, and we'll notify your contacts.
The default is Notify.
If you're setting up MTR for the first time, you must ensure that the Sophos MTR agent (which is included in the endpoint protection installer) is installed on customers' computers. See Deployment.
You can set custom MTR preferences for specific customers.
- Go to Settings & Policies > Managed Threat Response Preferences.
Click the Customize preferences tab and do as follows:
- Select a customer.
- In the Customize column, change the setting to Yes.
- In the Control column, click Configure. This opens the customer's MTR preferences in Sophos Central Admin so that you can edit them.
Enter your settings in the customer's Authorized Contacts and Threat response tabs.