05-23-2020 09:52 AM
Hi Team
We have enabled quarantine for wildfire and local analysis malware verdict. When initiating malware scan from cortex xdr cloud t, the malware's are getting detected and but those are not getting quarantined.Can anyone advice is this how it works?
05-26-2020 11:05 AM
Next thing I would check is the agent logs after a quarantine attempt.
You can use this test PE to trigger a quarantine event. After the event is complete, open the log file, scroll to the bottom and look for any messages associated with the quarantine attempt.
05-26-2020 10:27 AM
Can you post a screenshot of the Portable Executable and DLL Examination portion of your malware profile?
05-26-2020 10:55 AM
Hi @Marsooq_A-
Just to confirm. When you go to Endpoint Management > Endpoint Administration, select an endpoint that is failing, right-click and select View Endpoint Policy -- can you see the profile with quarantine enabled applied to the specific machine?
05-26-2020 11:02 AM
Yes , I could see the same profile in the policy and this has been confirmed several times.
05-26-2020 11:05 AM
Next thing I would check is the agent logs after a quarantine attempt.
You can use this test PE to trigger a quarantine event. After the event is complete, open the log file, scroll to the bottom and look for any messages associated with the quarantine attempt.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
