Managing Quarantined Files

Quarantine Management helps protect the network by isolating potentially harmful files and applications (malware, ransomware, suspicious files, and so on), preventing threats from spreading across the environment. It offers a centralized view, enabling security teams to manage quarantined items efficiently. Administrators can respond quickly to incidents, inspect suspicious content, and resolve issues by restoring safe files or removing malicious ones.

To view the Quarantine Management page, from the left navigation panel, click Asset Management > Quarantine Management.

00:03: Quarantine Management in Harmony Endpoint

00:05: gives you a safe and efficient way to deal with malicious and suspected files

00:09: across the organization. In this tutorial,

00:11: you will learn how to manage quarantined files in Harmony Endpoint.

00:16: From the Quarantine Management page, you can fetch files for deeper analysis,

00:20: restore clean files, or delete malicious

00:23: ones permanently. By combining visibility, control, and flexibility, Quarantine

00:27: Management helps reduce risk, accelerate incident response, and strengthen your overall

00:31: security posture.

00:33: To get started, log in to the Infinity Portal and select Harmony Endpoint.

00:39: From the left navigation panel, click "Asset Management".

00:42: To view the quarantine files. Click quarantine management.

00:45: This page allows you to view quarantined files grouped by either file or

00:49: device.

00:51: In the View by Files tab, each row represents a single file.

00:54: You can view details such as the file name, file path,

00:57: hash value, the blade that quarantined the file, its current status, and the number

01:01: of devices where the file was quarantined.

01:04: In the View by Devices tab, each row represents a single endpoint. It

01:08: displays the device name, operating system, version, and the total number of

01:12: quarantined files on that device.

01:15: From the Quarantine Management page, you can fetch a quarantined file, restore

01:19: a clean file that was quarantined, or delete a quarantine file.

01:23: Fetching a quarantined file allows you to securely

01:25: download it for analysis or inspection. To download a quarantined file, select

01:30: the checkbox relevant to the file and click Fetch file.

01:33: Select the destination for uploading the file, you can upload it to AWS

01:37: S3 or your organization's FTP server.

01:42: To upload a file to S3. Select S3, enter a password in the uploaded

01:46: file password, protected field and then click fetch.

01:49: You need this password to access the file on the AWS.

01:52: S3 server note that the file size should be less than 25 megabytes for uploading

01:56: to S3.

01:58: To upload the file to your organization's storage location via FTP,

02:01: select FTP, fill in the server details, login credentials, and

02:05: file path. Set a password to protect your uploaded file, then click 'Fetch' to

02:09: proceed.

02:10: The Restore Quarantined File option lets you recover files that were wrongly flagged as

02:14: threats. It also helps prevent future false detections by allowing exclusions

02:18: to be set.

02:20: Use the multi-select checkboxes to select the files

02:22: you want to restore.

02:24: Select Restore only to return the file to its original location.

02:27: However, if the same file is detected as malicious on any other

02:31: endpoint, it will be quarantined again.

02:34: Select Exclude and Restore to recover the file and add it to Global Exclusions.

02:38: This prevents the file from being flagged as malicious across all endpoints in

02:42: your network.

02:43: Click Proceed to complete the file restoration.

02:46: Deleting a quarantined file permanently removes it from the system.

02:51: Use the multi-select checkboxes to select the files

02:54: you want to delete permanently and click Delete.

02:57: In the Delete file confirmation pop-up that appears, click 'Delete.

03:02: Once a file is deleted, it cannot be restored.

03:05: Thank you for watching the video.