Sophos Endpoint in practice: alerts, false positives, device health and account health
A deeper Sophos Endpoint course built from Sophos's current help: working the alerts list (threat, PUA, ransomware, outbreak, installation and compliance alerts), handling false positives without weakening protection, reading a computer's health assessments, improving Account Health Check scores, turning tamper protection off safely for a change, and keeping updates flowing with Update Caches and Message Relays.
- Level
- Intermediate
- Length
- About 50 minutes
- Contents
- 3 lessons · 1 video · final exam
- Status
- Published · updated 2 Oct 2026
- Sophos
Skills you'll practise
- Choose the right action for an alert (acknowledge, resolve, clean up, authorize PUA) and explain what each does and does not do
- Handle a false positive by allowing an application by certificate, SHA-256 or path, choosing the narrowest suitable method
- Resolve an Outbreak Detected alert correctly and explain why detection reporting stops until it is resolved
- Diagnose a red or orange device from its health assessments and the installation and compliance alerts
- Explain how Account Health Check scores are calculated and fix the lowest score first
- Plan Update Caches and Message Relays for a remote site, including the ports they use
Course outline
- 1.Sophos Endpoint in practice: alerts, false positives and healthVideo · 2 min
- 2.Working the alerts listLesson · 18 min
- 3.False positives, PUAs and device healthLesson · 16 min
- 4.Account health, tamper protection changes and Update CachesLesson · 16 min
- 5.Sophos Endpoint in practice: alerts, false positives, device health and account health: knowledge checkKnowledge check · 16 questions
- 6.Final exam12 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- Sophos help: Alerts (severity, status, grouping, actions, outbreak alerts)
- Sophos help: Alerts for Threat Protection
- Sophos help: Alerts for installation and compliance
- Sophos help: Resolve PUA alerts
- Sophos help: Stop detecting an application (certificate, SHA-256, path)
- Sophos help: Stop detecting ransomware (exclude Detection ID)
- Sophos help: Deal with ransomware
- Sophos help: Deal with outbreaks
- Sophos help: Computer Status (health assessments, Endpoint Self Help, reset health status)
- Sophos help: Account Health Check
- Sophos help: Health check scores (how scores are calculated)
- Sophos help: Turn off Tamper Protection (global, per device, local override for up to 4 hours)
- Sophos help: Update Caches and Message Relays (ports, selection, requirements)
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.