Hi team,
I've seen this at multiple locations, where Sophos will prevent FME from installing custom transformers from the Hub (i.e. Emailer) and display a Lockdown alert, Sophos believes it to be malicious behavior.
Has anyone else experienced this? Is it possible for Safe to reach out to Sophos to see if this can be looked at, as the only way to get around this, is to allow exceptions per Transformer on the Sophos side and we have to re-do this each time we upgrade FME Desktop.
Is this downloading the file through the browser or fetching it using Workbench?
Is this downloading the file through the browser or fetching it using Workbench?
It's downloading it via Workbench and installing it automatically (well trying to)
It's downloading it via Workbench and installing it automatically (well trying to)
Try downloading it through your browser and installing it manually
https://hub.safe.com/publishers/safe/packages/emailer
I've experienced this exact issue - it would be nice if we could install custom transformers from Hub without Sophos blocking them.
I've experienced this exact issue - it would be nice if we could install custom transformers from Hub without Sophos blocking them.
Hi @ashh ,
Sorry, you are experiencing this! I've filed a ticket on our end to see if there is anything we can do to prevent this.
I spoke to a developer about this and he said the reason this may be happening is that we are essentially downloading .zip files that contain Python which may raise a red flag.
Just to confirm, if you go to FME Hub and download the files directly, does that work?
The developers were also interested in seeing any error logs from Sophos you may have. They did warn me, that there may be nothing they can do, as Sophos is third-party software and there may be settings that we cannot work around. However, we'd like to take a look to see if there is something we could be handling better!
Hi @ashh ,
Sorry, you are experiencing this! I've filed a ticket on our end to see if there is anything we can do to prevent this.
I spoke to a developer about this and he said the reason this may be happening is that we are essentially downloading .zip files that contain Python which may raise a red flag.
Just to confirm, if you go to FME Hub and download the files directly, does that work?
The developers were also interested in seeing any error logs from Sophos you may have. They did warn me, that there may be nothing they can do, as Sophos is third-party software and there may be settings that we cannot work around. However, we'd like to take a look to see if there is something we could be handling better!
Hi @siennaatsafe -- Yes this is correct. Even downloading this via the web, Sophos still blocks it.
From what we can see, it looks like it's executing multiple processes which is what raises the red flag with Sophos.