Restore Quarantined file in Traps

[AbdulRahman_Safwat]

Hello,

When a file is Quarantined in traps by a wildfire malware verdic or Hash Control policy, I realize that you can not restore the file from the Hash control policy unless you change the verdict first to benign, is this how it is supposed to work, as the admin guide does not require this step except that it will prevent Traps from keep quarantining the file, but my point is that the option to restore is greyed out and even if I try to do it from the action list it would show: "There were no candidates for Restore".

However I am able to restore it using cytool, even if the verdict is still malware.

So I want to confirm if "restore file" feature is enabled from ESM server only after changing the verdict to Benign.

Also I dont think it is a bug as I have tested it on ESM 4.2.1 and 4.2.2, and Traps agent 4.2.2 and 4.1.4.

Thanks

[AbdulRahman_Safwat]

I have just tested on ESM 4.1.4 and the same behaviour is there.

[briancaw · Accepted solution]

hi @AbdulRahman_Safwat

This is indeed an expected behavior as you said, to prevent files from getting quarantined again after restoration.

We will review our documentation  and correct it as needed to better clarify this behavior.

Thanks!