2. Configure a risk level for Unclassified sites. These sites have yet to be analyzed or reviewed
by SophosLabs and may compromise network security. The options are:
■
Low risk: (Recommended) This is the default setting. Files that Sophos considers unsafe
are scanned. SophosLabs maintains an up-to-date list of file types that are deemed unsafe.
■
Medium risk: All files on medium risk sites are scanned. Selecting this option will apply
the setting selected for medium risk sites as described above. If medium risk sites are set
to Scan, all files on unclassified sites are scanned, regardless of file type. Sophos
recommends setting unclassified sties to Low risk to ensure an optimal balance between
scanning and user experience.
■
High risk: All files on the site are blocked, regardless of file type.
3. Click Apply.
To view a list of local sites, click the Sites button next to the risk classification that you want to
view. The Local Site List page is displayed, and any local sites specified for that classification
are shown. You can also enter new sites by clicking Add Site. For more information, see
“Configuring the Local Site List” and “Using the Local Site List Editor”.
Related tasks
Configuring the Local Site List
on page 97
Using the Local Site List Editor
on page 99
4.3.2 Configuring Sandstorm
Sophos Sandstorm is a cloud-based service that provides enhanced protection against new and
targeted attacks. You can configure the appliance to send suspicious files to Sandstorm for
analysis or submit suspicious files on an individual basis. Sandstorm detonates the file to check
for malware and sends the results to you. Because the analysis takes place in the cloud, your
system is never exposed to potential threats.
This page of the administrative web interface is not available on a joined Web Appliance as this
functionality has been shifted to the Management Appliance.
The Configuration > Global Policy > Sandstorm page allows licensed users to enable Sophos
Sandstorm, a cloud service that executes and analyzes suspicious downloads. If you do not have
a license, you can obtain a 30-day trial license on this page.
Once enabled, you can set default Sandstorm profiles on the Configuration > Group Policy >
Default Policy and Configuration > Group Policy > Special Hours pages. You can also select
a custom Sandstorm profile for any additional policies you add or edit.
To turn Sandstorm on or off, click the On/Off switch.
You can view the current license status in the License status text box.
Files to be analyzed by Sandstorm are transmitted using a secure SSL connection to a data center
in the cloud. Data centers are located in the United States and Europe. Sandstorm selects the
closer data center according to the location of the appliance.
Sophos Web Appliance | Configuration | 103
