topic Re: Quarantining files about 300 MB / Hunting big Files in Cortex XDR Discussions

Quarantining files about 300 MB / Hunting big Files

RFeyertag — Sun, 10 Sep 2023 21:13:33 GMT

Hello dear community,

what happens with quarantined files, which have 300 MB?

I can't download it from the action center like I am used to.

Yes, I saw they are moved to %PROGRAMDATA%\Cyvera\Quarantine), but can I get it from there?

Would you hunt big files, which are executed by users?

Rob

Re: Quarantining files about 300 MB / Hunting big Files

jmazzeo — Mon, 11 Sep 2023 13:51:00 GMT

Hi @RFeyertag, thanks for contacting us in the Live Community.

I'll do some checks and I'll be back with more information about retrieving files from quarantine (without restoring them).

Is really hard to find a 300MB malware file, maybe a zipped one containing it. Is a size that is really hard to manage on any solution.

Re: Quarantining files about 300 MB / Hunting big Files

jmazzeo — Mon, 11 Sep 2023 17:07:02 GMT

@RFeyertag, I did some tests, and the files retrieved from the Qarantine folder, comes encrypted with a .qtn extension.

The option that comes to my mind, is:

- Restore the file to the original location.

- Retrieve it using the Action Center as you usually do.

The max size of the files is 500MB.

Please, le me know if it works for you, and mark the answer as the solution.

Thanks!

Re: Quarantining files about 300 MB / Hunting big Files

RFeyertag — Mon, 11 Sep 2023 19:03:12 GMT

Thank you so much for your attention to this question.

In my mind I was able to get the file from quarantine. But I think in this case it is too big or the isolated endpoint didn't allow it. Maybe the client also wasn't online anymore.

So, if I retreive files from quarantaine, the client needs to be online, right?

I will try your suggestion, thank you!

Rob

Re: Quarantining files about 300 MB / Hunting big Files

jmazzeo — Mon, 11 Sep 2023 19:08:56 GMT

Yes, if you need the files at the moment, it needs to be online. If it is not, the task is hold as "Pending" until the client connects again with the console.

I tried to retrieve files with the route %PROGRAMDATA%\Cyvera\QuarantineV2\*.* and all came encrypted.

Thanks!