Endpoint Protection

The Endpoint Protection menu allows you to manage the protection of endpoint devices in your network, e.g. desktop computers, servers, and laptops. Sophos UTM is the configuration side of endpoint protection where you deploy the software for endpoints, get an overview of the protected endpoints, set up antivirus and device control policies, group endpoints, and assign the defined policies to endpoint groups.

Endpoint protection uses a central service called Sophos LiveConnect. This cloud-based service is automatically set up for the use with your Sophos UTM once you enable endpoint protection. LiveConnect allows you to always manage all of your endpoints, whether they are on your local network, at remote sites, or with traveling users. The LiveConnect service provides:

• A pre-configured installation package for the endpoint agent
• Policy deployment & updates for endpoints
• Security updates and definitions for endpoints
• Central logging & reporting data to monitor endpoints centrally through WebAdmin

As LiveConnect is a cloud-based service you will need an active Internet connection in order for the service to work. Managed endpoints will need an Internet connection to receive policy and security updates, too.

The figure below shows a deployment example of Sophos UTM Endpoint Protection with the use of the LiveConnect Service.

Endpoint Protection: Overview

The following topics are included in this chapter:

• Computer Management
• Antivirus
• Device Control
• Web Control

If endpoint protection is enabled, the overview page gives you general information on registered computers and their status. You can sort and search this list. If the status of an endpoint is not OK, you can click on the status to open a window with more information. The status Not Compliant indicates that the device's settings are currently not the same as configured on Sophos UTM. To resolve this problem you find a link in the window to send the current endpoint settings to the endpoint. For the other statuses you can acknowledge the information and decide what actions have to be taken.

Open Endpoint Protection Live Log

The endpoint protection live log gives you information about the connection between the endpoints, LiveConnect, and Sophos UTM, as well as security information concerning the endpoints. Click the Open Endpoint Protection Live Log button to open the endpoint protection live log in a new window.