Sophos Intercept X via Sophos Central

The RRZK offers all employees of the University of Cologne the product Sophos Intercept X free of charge via Sophos Central to protect their work devices. This product is the official successor to the previous product Sophos Endpoint Protection, which has not been receiving updates since July 20, 2023 and may therefore no longer be used.

Sophos Intercept X offers additional protection against ransomware, also known as encryption trojans, in addition to protection against viruses and malware. In contrast to the previous product, it is no longer necessary to connect to the university's network (UKLAN) via VPN in order to carry out updates, so that business devices can also be reliably supplied with updates when away on business trips or when working from home. The configuration is managed by RRZK and cannot be adjusted by end users.

In few individual institutes, such as the Biozentrum, a separate Sophos Central instance is operated; if necessary, contact your institute IT beforehand.

Note: For home devices, i.e. PCs not procured by the university, Sophos Home Premium is available. Sophos Intercept X is not suitable for home devices!

Before installing Sophos on your business device, please read the instructions on this website in full.
You will find both installation and uninstallation instructions here (see the links either on the right hand side or below).

Notes

Data processing

Sophos Central is a cloud service. All devices protected with Sophos Intercept X via the University of Cologne license communicate with the Sophos Central service. The associated servers are located in Germany and are subject to German data protection law.

RRZK's employees may receive notification of the status of the devices in order to assess the current threat situation and offer support to users. At no time will RRZK's employees have full access to your data or your computer though Sophos Central.
Data that may be displayed to authorized RRZK employees includes:

Computer name (selectable by owner).
IP addresses of all network adapters
Installed operating system
User name of the last logged in user (in principle freely selectable by the user, except for computers that are located in a domain)
Time of the last connection of the device to Sophos Central
Security status
Status of the Windows firewall
Event messages about updates that have taken place or detection of malware

Tamper protection

The software has tamper protection by default. This feature is intended to prevent the protection for the end device from being disabled.

If desired, this feature can be disabled temporarily or permanently. However, please note that malware can then also potentially disable the protection.

So only deactivate the tamper protection if you consider it necessary and, if necessary, ask the RRZK for advice on this topic. A possible use case is the uninstallation of the software, which is also only possible with the tamper protection disabled. Please note in particular that temporary or permanent deactivation is only possible by contacting the RRZK. For temporary deactivation, you can obtain a one-time code; permanent deactivation of the tamper protection can be performed centrally by the RRZK. Get in touch with RRZK's help desk for both types of requests.

Support

If you need support for this software, contact the RRZK helpdesk. You need your device name so that we can see the information about your device. If you only need general information the device name is of course not necessary.

Depending on the operating system, the ways how you can view the name may differ. In Windows 10, you can find it by right-clicking on the start icon → "System" and there under "Device name". Alternatively, in Sophos Endpoint Agent under Information → Open Endpoint Self Help Tool → System → Computer Name. The RRZK helpdesk can assist you in finding this device name if you have difficulties.

System requirements

Contact
If you have any questions or problems, please contact the RRZK-Helpdesk

UNIVERSITY OF COLOGNE