Use Sophos Assistant safely on Sophos Firewall

Sophos Assistant combines a search of help content with resources and guided workflows in Sophos Firewall WebAdmin. The AI answer is a summary drawn from Sophos help, not general advice on arbitrary questions. Before changing a configuration, check the linked help and distinguish a purely explanatory Feature tour from a Configuration flow, in which you actually carry out the task.

For a quick start: Open the Sophos Assistant tab on the right of WebAdmin, enter a search phrase containing at least two words and press Enter to search. Read the answer under Answers and open the relevant help pages under Sources. If the resources are missing when you open the assistant, clear the search field and click an empty area inside the assistant.

The procedures below describe the functionality documented in the SFOS 22.0 and SFOS 23.0 help. To follow them, you need a WebAdmin session with Sophos Assistant available. Whether the assistant should remain enabled is a separate operational decision: Firewall hardening explains the setting, signing in again after changing it, and the separate assessment of firewall telemetry. This guide does not extend access permissions or duplicate the procedure for disabling the assistant.

Open, close and reposition the window

Open the window using the Sophos Assistant tab on the right-hand edge of the WebAdmin console. It contains a search bar and help resources such as flows, help pages and videos.

There are three ways to close it: the X in the title bar, a click outside the window, or Esc. When you close it, the assistant remembers its state, including the window size and search term. Reopening it is therefore not a reliable way to reset an earlier search.

If the window obscures a part of WebAdmin that you need, move the tab:

1. Close Sophos Assistant first if it is open.
2. Move the pointer over the tab until the grid symbol appears.
3. Once the pointer becomes a four-arrow cross, drag the tab.
4. Drop it at one of the available positions indicated by small markers, then reopen the assistant.

The check is straightforward: the area of the console you need should now be accessible. Repositioning changes the location of the help, not the firewall configuration.

Search and check AI answers

Enter a term or phrase in the search bar. As you type, the assistant suggests search terms. Either click a suggestion or finish entering your own phrase and press Enter. Click a search result to open it. Alongside AI content, the results may include closely related help pages, other help pages and Sophos Assistant flows.

An AI answer requires at least two words. A normal search and the requirement for an AI answer are therefore not the same thing. A harmless example is firewall rules: it contains two words and no customer or configuration data. A more precise phrase such as configure firewall rules narrows down the intended task further. According to Sophos, longer search phrases produce more relevant answers; however, these examples guarantee neither a particular answer nor a specific result.

The AI view contains:

• Answers: A summary answer drawn from the firewall help pages appears at the top.
• Sources: Links to firewall help pages closely related to the search phrase appear below it.
• Thumbs up or thumbs down: At the bottom right of the AI section, you can rate how relevant the generated content is to the search phrase.

Before following an instruction, open the relevant entries under Sources and check whether the task, prerequisites and settings described apply to your situation. A plausibly worded summary is no substitute for this check. If the answer is unsuitable, make the search phrase more specific, read the help pages directly and provide relevance feedback if needed. If no AI answer appears, first check that the phrase contains at least two words; a single search word does not entitle you to expect an AI answer.

Select and recover help resources

Help pages can open as a pop-up within WebAdmin or as a full page in another browser tab. This lets you read a brief explanation alongside the current task or keep the detailed help open separately.

The resource types serve different purposes:

• Flow: A sequence of guided steps that highlights areas of WebAdmin.
• Help page link: A link to the detailed product help.
• Video: A resource in video format.
• Article: A concise explanation of a topic.
• Collection: A group of related resources, for example, for the same audience or topic.

If no available resources are visible after opening the assistant, first clear the search bar, then click an empty area inside Sophos Assistant. This is the documented way to restore the resource view. Simply closing the window may not be enough because the search term is retained. The list of available help resources should then be visible again. If it is still missing, investigate that specific symptom; do not infer either a successful recovery or a change to a firewall setting.

Distinguish Feature tours from Configuration flows safely

A flow guides you through a task step by step. Each step highlights an area of the WebAdmin console and displays information about it. Before starting, make sure you know which type of flow you have selected:

• Feature tours demonstrate how a task works without performing any actions. At the end, you know how to complete the task; this does not mean it has been configured.
• Configuration flows guide you through the actual task. You select options or enter values; at the end of the fully completed flow, the task is done. These flows are not merely a preview. Before entering anything, clarify the intended change and the values appropriate for your environment.

Flows for tasks involving several modules are grouped in folders. Individual flows for a single module appear further down, after the folders. Alternatively, you can search for any flow.

Use Back and Next to move through the steps. The X in a step’s title bar cancels the flow. If you lose your place, you can close it and start it again from Sophos Assistant.

Cancelling or restarting is not a documented rollback. The help describes ending and restarting the flow, but does not promise to undo configuration changes already made. After cancelling a Configuration flow, check the affected settings before continuing your work. Even when a flow ends normally, what matters is checking the completed task, not simply reaching the last step. A Feature tour, by contrast, is not evidence that a configuration has been implemented. If a Configuration flow changed a firewall rule, use the firewall rule testing guide to verify its actual effect.

At the end of every flow, there is a feedback form: select Thumbs up or Thumbs down, then click Send Feedback. Before sending, you can optionally select a predefined answer or enter a suggestion in the text box. This flow feedback is separate from the relevance feedback provided directly on an AI answer.

Documented data and search boundaries

Sophos describes the AI summaries and links as using Large Language Models (LLMs) trained on these Sophos sources: content and links from the Sophos Firewall help, and flows and articles in Sophos Assistant. According to this description, the AI model accesses only these content types and generates content from Sophos sources within that search scope. This limits the documented knowledge base; it is not a promise of a general analysis of your own firewall configuration.

The statements about data must be read together: according to Sophos, the AI model stores only event analytics relating to search phrases and AI responses. Sophos Assistant also stores analytics on the use of its content, specifically the links, flows, smart tips and articles used. At the same time, Sophos states that user data is not stored and identifies improving the relevance of content for customers as the purpose of the analytics.

This means neither that no analytics take place nor that there is a blanket privacy guarantee for arbitrary input. As a safe operational practice, use factual search phrases without passwords, personal details or confidential customer information. These statements about the assistant also do not replace a separate assessment of Sophos Adaptive Learning and the firewall’s baseline configuration and usage reporting; that decision remains covered in the linked hardening article.