Quarantine not working

[Marsooq_A]

Hi Team

We have enabled quarantine for wildfire and local analysis malware verdict. When initiating malware scan from cortex xdr cloud t, the malware's are getting detected and but those are not getting quarantined.Can anyone advice is this how it works?

[dfalcon]

Can you post a screenshot of the Portable Executable and DLL Examination portion of your malware profile?

[Marsooq_A]

[dfalcon]

Hi @Marsooq_A-

Just to confirm.  When you go to Endpoint Management > Endpoint Administration, select an endpoint that is failing, right-click and select View Endpoint Policy -- can you see the profile with quarantine enabled applied to the specific machine?

[Marsooq_A]

Yes , I could see the same profile in the policy and this has been confirmed several times.

[dfalcon · Accepted solution]

Next thing I would check is the agent logs after a quarantine attempt.  

https://docs.paloaltonetworks.com/wildfire/8-1/wildfire-admin/submit-files-for-wildfire-analysis/ver...

You can use this test PE to trigger a quarantine event.  After the event is complete, open the log file, scroll to the bottom and look for any messages associated with the quarantine attempt.

[Marsooq_A]

well its works with other endpoints