05-07-2026 11:35 AM
Hi there,
We are having issues with files being quarantined on BIOCs but they are not appearing in the Action Center-->File Quarantine.
We have verified both Broker VM and local machines experiencing this issue are not anywhere near storage quota.
We can see the quarantine appearing in the trapsd.log file and we can see the packets making it from the local machines to the data broker.
We tried reverting to an earlier version of the XDR to no avail so have re-upgraded to the latest.
Additionally, I don't know how to correlate the noted Rule to the BIOC Rules. The Additional information 1 in the quarantine pop up shows "Rule bitsjob_amsi_suspicious_strings
Please let me know if you have any ideas or what greater information might be helpful to solve this.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
