Sophos Docker



I too am interested in knowing this. Am using Sophos XG18, and running Unraid NAS with Docker containers. KingChris when you say point to your Docker server, in my scenario, the Docker is on the NAS. I access Docker containers via NAS IP:port. Example will be 10.10.20.2:4040, another container will be 10.10.20.2:9090.

You can exclude files, websites and applications from scanning for threats.

You use exclusions to tune the detection behavior of Sophos Central.

Sophos Docker Free

These exclusions will apply to all your users (and their devices) and servers. If you want them to apply only to certain users or servers, use policy exclusions instead.

Sophos Antivirus Docker

At this point, the system is running Sophos XG Firewall Software Appliance. After the first boot, the system will present details about the hardware configuration and prompt for a password. The default password is admin. Accept the EULA by pressing a. Per default, the Sophos XG assigns the IP address 172.16.16.16 to its first NIC. Sophos Anti-Virus for UNIX Notes:.Limited support means that Sophos will continue to test and release new versions of the Virus Engine and Virus Data Library as part of the release calendar. Only critical product issues will be addressed, including hotfixes, vulnerabilities, or improvements to protection, at Sophos’ discretion. Find out how Sophos Cloud Optix protects your container images. A Docker container image is an unchangeable file that contains the source code, libraries, dependencies, tools, and other files needed for an application to run. Docker containers are based on Docker images, which can be stored in different types of registry. Simple server that scrapes Nginx vts stats and exports them via HTTP for Prometheus consumption.

CAUTION Think carefully before you add global exclusions because doing so may reduce your protection.
Docker

You can exclude files or folders from scanning. You can exclude any process running from an application. You can exclude websites from checking. You can also exclude applications that are normally detected as spyware and previously detected exploits from scanning and detection. You can also exclude applications from protection against security exploits.

You can also use exclusions to allow isolated devices to communicate with other devices under restrictions. This feature is available if you have Intercept X Advanced with EDR.

Sophos

Sophos Docker

Note If an option is locked global settings have been applied by your partner or Enterprise administrator. You can still stop detecting applications, exploits and ransomware from events.

If you exclude files from scanning, we'll still check the excluded items for exploits. If you want exclusions from exploit checking, do as follows:

  • To stop checking for an exploit that has been detected, use a Detected Exploits exclusion.
  • To exclude certain applications from checking, use Exploit Mitigation Exclusions.

To set exclusions:

Docker

Sophos Docker Linux

  1. Go to Global Exclusions.
  2. Click Add Exclusion (on the right of the page).
  3. In the Exclusion Type drop-down list select what you want to exclude.
  4. Specify the item or items you want to exclude.

    File or folder (Windows)

    You can exclude a drive, folder or file by full path. You can use the wildcard * for file name or extension but *.* is not valid.

    File or folder (Mac/Linux)

    You can exclude a folder or file. You can use the wildcards ? and *.

    File or folder (Sophos Security VM)

    On Windows guest VMs protected by a Sophos security VM, you can exclude a drive, folder or file by full path. You can use the wildcards * and ? but only for file names.

    Process (Windows)

    You can exclude any process running from an application. This also excludes files that the process uses (but only when they are accessed by that process). If possible, enter the full path from the application.

    Website (Windows/Mac)

    You can specify websites for exclusion using IP address, IP address range (in CIDR notation), or domain.

    Potentially Unwanted Application (Windows/Mac)

    You can exclude applications that are normally detected as spyware.

    Specify the exclusion using the same name under which it was detected by the system.

    Find more information about PUAs in the Sophos Threat Center.

    Detected Exploits (Windows/Mac)

    You can exclude any exploit that has already been detected. We'll no longer detect it for the affected application and no longer block the application.

    Device isolation (Windows)

    You can allow isolated devices to have limited communications with other devices.

    Choose whether isolated devices will use outbound or inbound communications, or both. You can then restrict communications.

    Malicious Network Traffic Prevention (IPS) (Windows)

    You can exclude specific network traffic from inspection.

    Choose whether to exclude outbound or inbound traffic. Then specify the address or ports the traffic uses.

    Exploit Mitigation (Windows)

    You can exclude applications from protection against security exploits.

    For example, you might want to exclude an application that is incorrectly detected as a threat until the problem has been resolved.

    AMSI Protection (Windows)

    You can exclude a drive, folder or file by full path. Code in this location is not scanned. You can use the wildcard * for file name or extension.

  5. For File or folder exclusions, in the Active for drop-down list, specify if the exclusion should be valid for real-time scanning, for scheduled scanning, or for both.
  6. Click Add or Add Another. The exclusion is added to the scanning exclusions list.

Sophos Docker Install

To edit an exclusion later, click its name in the exclusions list, enter new settings and click Update.