Sophos #How to uninstall & install software client/server

Here they are some useful articles that indicate on how to safely uninstall Sophos Antivirus,

Sophos Central Endpoint and Server: Uninstall Sophos using the command line or a batch file

https://support.sophos.com/support/s/article/KBA-000003469?language=en_US

Remove Sophos Central without tamper protection password

https://community.sophos.com/community-chat/f/discussions/134537/remove-sophos-central-without-tamper-protection-password

SophosZap: Frequently asked questions (to be used only as last chance)

https://support.sophos.com/support/s/article/KBA-000006929?language=en_US

Sophos Central Endpoint: Automate the software deployment to Windows devices

https://support.sophos.com/support/s/article/KBA-000003140?language=en_US

Sophos Central Endpoint: Installer command line options for Mac and Windows

https://support.sophos.com/support/s/article/KBA-000004840?language=en_US


[update 2025.08.20]

If your tamper protection is not recognized you might fix following this procedure:

1. Execute command line prompt with administrative rights

2. cd "C:\Program Files\Sophos\Endpoint Defense\"

3. You will be located in C:\Program Files\Sophos\Endpoint Defense\

4. Run SEDcli.exe -TPoff password (where password is the one that you view on Sophos Central console)


Sophos #XDR feature, adaptive attack protection

About sophos Intercept X Advanced with XDR and other Sophos features I take note, on blog, about some related articles:

Sophos Intercept X Advanced with XDR: Help with Forensic Snapshots

https://support.sophos.com/support/s/article/KBA-000006333?language=en_US+

Sophos XDR-enabled devices continually capture data related to processes, files, networks, and other system activities. When threat detection occurs, a snapshot file of current activity is created on the device's disk. This snapshot helps generate the Threat Case in Sophos Central, which attempts to piece together the threat chain of an attack and identify related activities.

Data Lake uploads

https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/ThreatAnalysisCenter/LiveDiscover/DataLakeUploads/index.html

Sophos XDR: Getting Started with XDR and Data Lake Hydration

https://techvids.sophos.com/watch/JWndawT866eCh9gVXTNE2K

Sophos Intercept X: Adaptive attack protection

https://support.sophos.com/support/s/article/KBA-000008632?language=en_US

This protection feature is part of the malicious behavior protection capability in the Sophos endpoint. It consists of a series of technique-focused behavioral rules intended to disrupt the actions of a threat actor.

Admin Isolated Devices

https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/GlobalSettings/IsolatedComputers/index.html


[UPDATE 2025.06.05]

Sophos Endpoint: Adaptive Attack Protection Gets Even Better

https://news.sophos.com/en-us/2024/04/29/sophos-endpoint-adaptive-attack-protection-gets-even-better/

Network #Some switch commands

On Cisco switches you can review single port configuration

show running-config interface Gi4/0/13

In case you would like to reset single port configuration:

Config t

default interface GigabitEthernet 4/0/13



Network #PKI-4-TRUSTPOOL_EXPIRATION_WARNING

We faced, on several Cisco switches, this warning:

Mar  8 11:11:52.680: %PKI-4-TRUSTPOOL_EXPIRATION_WARNING: The Trustpool will expire in 20 days

Mar  8 11:11:52.680: %PKI-4-TRUSTPOOL_AUTO_UPDATE_DISABLED: Auto-trustpool update is disabled.

In Cisco IOS XE version 17.12.04, the auto-update feature for the PKI trustpool is enabled by default. This means the device will automatically download and update the trustpool bundle from Cisco's servers when necessary.

How Auto-Update Works

When the PKI trustpool is due for an update—due to reasons like certificate expiration, reissuance, or the addition of new trusted certificates—the system will:Cisco

  1. Attempt to download the updated trustpool bundle from the configured URL.
  2. If the download is successful, the trustpool is updated.
  3. If the download fails, the system will retry at increasing intervals: 20 days, 15 days, 10 days, 5 days, 4 days, 3 days, 2 days, 1 day, and then hourly until successful.Cisco

This process ensures that the device maintains an up-to-date set of trusted root certificates, which is crucial for secure operations like HTTPS, VPNs, and Smart Licensing.

unfortunately, in our case, this configuration command was missing

crypto pki trustpool policy

 cabundle url http://www.cisco.com/security/pki/trs/ios.p7b

 revocation-check none

to manual import certificate you must launch, through config t, this command:

crypto pki trustpool import url http://www.cisco.com/security/pki/trs/ios.p7b

to avoid problems we launched this 

to view certificate status this is command

show crypto pki trustpool policy

[other articles]

https://community.cisco.com/t5/switching/trustpool-expiration-on-3750-x/m-p/2423362#M286822


PKI Trustpool Management

Iphone #How to trasfer HEIC and HEVC photo to PC (in JPEG format)

With the release of iOS 11 and macOS High Sierra in 2017, Apple made the shift to HEIC and HEVC photo and video formats. These file formats can compress photos by up to 50% without losing any image quality.

The major problem is that HEIC and HEVC format is not widely supported (mainly on PC or other devices).

To transfer photo to other devices in .jpeg format here it is procedure that you should apply to your iphone

  1. Go to Settings > Photos.
  2. Scroll down to the Transfer to Mac or PC section.
  3. Tap Automatic.


more details are here indicated