Error code
Sophos All models code LAT-4896
No approved translation for this record yet; showing the original text.
Meaning
Customers (Central Dashboard and Enterprise Dashboard), as well as Partners (Partner Dashboard) - could see excess amounts of Audit log entries that reference both 'alerts:read' and 'endpoint-state:read'. What are these audit log entries? These are entries made by your Partner's RMM applications that utilize our Sophos plug-in/Management APIs. It is the Sophos Plugin running on the Partners Server that is the source of the request. (examples of some of the utilities: https://community.sophos.com/sophos-integrations/w/integrations ) Why do I see this in my Audit Log? The RMM Sophos software plug-in is polling all of the Partner's Customers. This currently includes any of the Partners customers who are either not managed by the Partner or are currently Trial/Evaluation customers. Our APIs handle the rejection of non-managed tenants by understanding the permissions embedded in the API token, and returning a 403 when the credential does not have permission for that tenant. This in turn results in an Audit log entry for access denied being logged in both the Central Dashboard (and the corresponding Partner and/Enterprise Dashboards) Can these entries be prevented? If the entries are onc
Member details
Signed-in members see the LED pattern and how to read the code with the remote control on eligible records.
View details as a memberSolution
Solution steps are available to members and are not shown on this page. Answer the questions to open the solution.
Remote technician support
Get help from a technician over a video call.
Address of this page: https://www.remfixit.com/tr/sophos/tum-modeller/lat4896