Managing the quarantined files
The behavior of the quarantine is different for each environment:
Security for Endpoints stores the quarantined files on each managed computer. Using Control Center you have the option to either delete or restore specific quarantined files.
Security for Virtualized Environments (Multi-platform) stores the quarantined files on each managed virtual machine. Using Control Center you have the option to either delete or restore specific quarantined files.
Restoring quarantined files
On particular occasions, you may need to restore quarantined files, either to their original location or to an alternate location. One such situation is when you want to recover important files stored in an infected archive that has been quarantined.
Note
Restoring quarantined files is only possible in environments protected by Security for Endpoints and Security for Virtualized Environments (Multi-Platform).
To restore one or more quarantined files:
Go to the Quarantine page.
Choose Computers and VMs.
Select the check boxes corresponding to the quarantined files you want to restore. Quarantined files located inside archives can only be restored to a custom location.
Click the Restore button on the upper side of the table.
Choose the location where you want the selected files to be restored (either the original or a custom location on the target computer).
If you choose to restore to a custom location, you must enter the absolute path in the corresponding field.
Click Save. You can notice the pending status in the Action status column.
The requested action is sent to the target endpoints immediately or as soon as they get back online. You can view details regarding the action status in the Tasks page. Once a file is restored, the corresponding entry will disappear from the Quarantine table.
Adding exclusions for quarantined files
To exclude a quarantined file:
Go to the Quarantine page.
Choose Computers and VMs.
Select the checkbox corresponding to the quarantined file you want to exclude.
Click the Add exclusions button on the upper side of the table and confirm your action. The exclusion is automatically created and displayed in the Exclusions list from the Configuration Profiles page.
Automatic deletion of quarantined files
By default, quarantined files older than 30 days are automatically deleted. This setting can be changed by editing the policy assigned to the managed endpoints.
To change the automatic deletion interval for quarantined files:
Go to the Policies page.
Find the policy assigned to the endpoints on which you want to change the setting and click its name.
Go to the Antimalware > Settings page.
In the Quarantine section, select the number of days after which files are being deleted.
Click Save to apply changes.
Manual deletion of quarantined files
If you want to manually delete quarantined files, you should first make sure the files you choose to delete are not needed.
A file may actually be the malware itself. If your research leads you to such a situation, you can search the quarantine for the specific threat and delete it from the quarantine.
To delete one or more quarantined files:
Go to the Quarantine page.
Select Computers and VMs.
Select the check boxes corresponding to the quarantined files you want to delete.
Click the Actions button at the upper side of the table and select Delete. Click Yes to confirm your action.
You can notice the pending status in the Action status column.
The requested action is sent to the target network objects immediately or as soon as they get back online. Once a file is deleted, the corresponding entry will disappear from the Quarantine table.
Emptying the quarantine
To delete all the quarantined objects:
Go to the Quarantine page.
Select Computers and VMs.
Click the Actions button and select Empty Quarantine.
In the confirmation window, select the option Include sub-companies quarantine to also delete the quarantined objects for your child companies, and click Delete.
All the entries from the Quarantine table are cleared. The requested action is sent to the target network objects immediately or as soon as they get back online.