When files are detected and moved to the Quarantine Manager (QM), what is the length of time that they stay inside the QM? Is there some standard default to which they are automatically remediated?
This thread was automatically locked due to age.
When files are detected and moved to the Quarantine Manager (QM), what is the length of time that they stay inside the QM? Is there some standard default to which they are automatically remediated?
Hello it_weasel15,
are you talking about Windows Endpoint?
moved to the Quarantine Manager
just for clarification: Even though the message says Moved to quarantine no actual movement takes place, only an entry is added to QM for this detection.
automatically remediated
Entries are only created when a threat has not properly been dealt with. Either Automatic cleanup was not set, not available for this threat, or failed and the alternate action was Deny access only, or the alternate action also failed (a successful move to default location does not add the item to QM). Thus without further deliberate action the length of time is forever. A later change in the policy will not cause the entries in QM to be reprocessed.
Christian
Hello it_weasel15,
are you talking about Windows Endpoint?
moved to the Quarantine Manager
just for clarification: Even though the message says Moved to quarantine no actual movement takes place, only an entry is added to QM for this detection.
automatically remediated
Entries are only created when a threat has not properly been dealt with. Either Automatic cleanup was not set, not available for this threat, or failed and the alternate action was Deny access only, or the alternate action also failed (a successful move to default location does not add the item to QM). Thus without further deliberate action the length of time is forever. A later change in the policy will not cause the entries in QM to be reprocessed.
Christian