Just finished my 30-day trial of Sophos Intercept X on my dev server (Ubuntu 22.04). I ran it alongside my usual containers to see what it would catch.
The detection part was solid. It flagged a suspicious curl command inside a container that my other tools missed. That was impressive! But the UI/UX felt clunky. The Central dashboard has so many sections, and finding the specific alert logs took way too many clicks. Also, setting up exclusions for my CI/CD pipeline containers was not intuitive.
For example, I tried to exclude a directory `/app/temp` in a container policy. The syntax in the policy editor wasn't clear. I ended up with a config that looked like this, but I'm not sure it's right:
```json
{
"exclusions": {
"linuxFiles": [
"/app/temp/**"
]
}
}
```
Did anyone else find the policy management a bit confusing? The protection seems great, but the interface makes simple tasks harder than they should be.
Containers are magic, but I want to know how the magic works.