Sophos Reporter Release Notes

Sophos Reporter 3.0.1.41 (2020-08-07)

Fixed issue that bloats bandwidth figures when the same traffic is logged in both the Content Filtering and Firewall Rule log files.
Filtering reports by Filename Extension no longer requires the extension to be entered in UPPERCASE.
Fixed an issue where strange Search Terms such as “56,148,835,15” were being extracted from YouTube.
Fixed issue preventing picklists from being presented when filtering by certain fields such as Event/Message Types.

Sophos Reporter 3.0.1.40 (2020-06-25)

Added support for Sophos UTM (SG) VPN logs. The VPN Dashboard and the VPN Section of the IT Network and Security report will now be populated with SSL VPN traffic handled by your Sophos UTM (SG).
Reports can now be filtered by ‘Manager’. For example, select Manager ‘Equal to’ Bob to filter a report by all of Bob’s employees/subordinates as defined in Active Directory. You can of course schedule this report to send to Bob every day, week or month.
Fixed issue preventing YouTube searches from being extracted.

Sophos Reporter 3.0.1.39 (2020-06-10)

Changes to default Alerts:
- Added Drug Searches alert.
- Added Content Keyword Matches alert.
- Added Policy Overrides alert.
- Removed Site Resource criteria from existing Search Term alerts as this is now handled in the Search Term extraction.
- Changed Downloads > 100 MB to Downloads > 1 GB and decreased its priority to Medium.
- The Unproductive Browsing alert now triggers when over 1 hour of unproductive browsing occurs within four hours.
Note: If upgrading, you will not see the new Alerts automatically. Please see our article on Updating Alerts to the latest version while keeping any custom alerts.
When configuring an alert, the Alert Evidence table is now populated with fake/example data when you select the Content Match, Content Prefix, Content Suffix, Override Authorizer, Override Name and Override Token fields.

Sophos Reporter 3.0.1.38 (2020-05-12)

Fixed issue where the Schedule Report button would not work (issue was introduced in build (3.0.1.35)
Fixed issue where links to Private Reports would no longer work once the Fastvue Reporter service is restarted.
Fixed URL parsing issue where URLs shorter than 15 characters with no scheme (e.g. http or https) appeared as an invalid URL.
Viewers of Private Reports can now export the report to PDF or CSV.
Fixed issue where the Connected and Disconnected times in the VPN sessions widget were truncated when exported to PDF.
Added support for Sophos XG’s download_file_name and Upload_file_name fields. These are imported into the ‘Filename’ field.

Sophos Reporter 3.0.1.37 (2020-04-23)

Added a new VPN Dashboard, and a VPN section to the IT and Network Security Report.

You can now monitor the number of active VPN sessions throughout the day to help plan for extra capacity or use the reports to find who has not connected recently.

You can also easily see when most people connect and disconnect, and proactively respond to unexpected disconnections or excessive invalid login attempts.

For more information, see Introducing Sophos VPN Reports and VPN Dashboard

Fixed issue where launching reports from an existing report (via hover-over) includes an extra date in the date range, and shows an incorrect date range in the report title.

Sophos Reporter 3.0.1.36 (2020-04-14)

Started work on the VPN Dashboard and VPN section in the IT and Network Security Report
Fixed issue where a CSV report is always attached when a report is shared via email or scheduled on the Reports tab with all attachment formats unchecked.

Sophos Reporter 3.0.1.35 (2020-03-30)

Sophos Reporter 3.0.1.34 (2020-03-18)

No change. Fixes for Fastvue Reporter fo FortiGate, Reporter for Palo Alto and Reporter for Sophos Web Appliance caused a Fastvue Reporter platform version number increment.

Sophos Reporter 3.0.1.33 (2020-03-11)

No change. Fixes for Fastvue Reporter fo FortiGate caused a Fastvue Reporter platform version number increment.

Sophos Reporter 3.0.1.32 (2020-03-11)

Fixed an issue that may prevent Search Term Alerts from working after the alerts are edited. If you’re experiencing this issue, edit your Search Term alert, and make sure the filter for Site Resource with the values /s and /su are set to ‘Not equal to’. There was an issue where this portion of the filter would be set to ‘Equal to’ if the alert was edited and saved, preventing the alert from working correctly.
Fixed issue that may result in out of memory issues after startup when the data retention policy attempts to calculate the size of old / closed indexes.
Elasticsearch no longer writes out enormous heap dump files when it runs out of memory. Any existing heap dump files will be deleted when disk space gets low.
Added Source Hosts and MACs section to the IT and Network security report.
Installation now cleans up Elasticsearch package extraction temporary files even if the extract fails.
Fixed issue in Alert Settings where the Alert Evidence Config Table sets example data to ‘User’ after the table is loaded.