Version Notable Changes

Sophos Email Appliance SEA can now communicate with Sophos Sandstorm, a cloud service that executes and analyzes suspicious attachments, providing another, more sophisticated layer of protection for your organization.

For more details on Sophos Sandstorm, please visit Sophos Sandstorm.

Sandstorm License

You need to acquire a License for Sophos Sandstorm. Please contact your Sophos Representative for more details.

However, you can enable a free, 30-day Trial from the Dashboard panel which redirects you to the Sandstorm page, as shown below.

You can check the status of your License from Help > About.


Once enabled, a summary of Sophos Sandstorm results is available on the Sophos Sandstorm dashboard panel.

The status of the Sandstorm service, whether it is On or Off, is displayed in the System Console panel.


Once you have purchased a license for Sophos Sandstorm or enabled a Trial, it can be accessed on the Configuration > Policy > Sandstorm page. You can also start a 30-day trial of Sophos Sandstorm from this page.

Sandstorm policies

You can create a Sandstorm policy for enhanced threat protection against malicious messages.

Mail Queue

The Sandstorm Queue in the Search tab displays the list of messages under analysis at that time.


A new Reports > Mail Trends > Sandstorm Volume report displays the number of malicious and clean messages detected for the selected time period.