Managing the quarantined files
The behavior of the quarantine is different for each environment:
Security for Endpoints stores the quarantined files on each managed computer. Using Control Center you have the option to either delete or restore specific quarantined files.
Security for Virtualized Environments (Multi-platform) stores the quarantined files on each managed virtual machine. Using Control Center you have the option to either delete or restore specific quarantined files.
Restoring quarantined files
On particular occasions, you may need to restore quarantined files, either to their original location or to an alternate location. One such situation is when you want to recover important files stored in an infected archive that has been quarantined.
Note
Restoring quarantined files is only possible in environments protected by Security for Endpoints and Security for Virtualized Environments (Multi-Platform).
To restore one or more quarantined files:
Go to the Quarantine page.
Choose Computers and VMs.
Select the check boxes corresponding to the quarantined files you want to restore. Quarantined files located inside archives can only be restored to a custom location.
Click the Restore button on the upper side of the table.
Choose the location where you want the selected files to be restored (either the original or a custom location on the target computer).
If you choose to restore to a custom location, you must enter the absolute path in the corresponding field.
Click Save. You can notice the pending status in the Action status column.
The requested action is sent to the target endpoints immediately or as soon as they get back online. You can view details regarding the action status in the Tasks page. Once a file is restored, the corresponding entry will disappear from the Quarantine table.
Adding exclusions for quarantined files
To exclude a quarantined file:
Go to the Quarantine page.
Choose Computers and VMs.
Select the checkbox corresponding to the quarantined file you want to exclude.
Click the Add exclusions button on the upper side of the table and confirm your action. The exclusion is automatically created and displayed in the Exclusions list from the Configuration Profiles page.
Retrieving and downloading quarantined files
You can remotely download quarantined files directly from the Quarantine page. This option enhances the flexibility and control of accessing quarantined files within your network whenever needed. The file is initially retrieved and then downloaded as a password-protected archive on your computer.
Additionally, you can allow your direct Bitdefender partner to retrieve and download quarantined files from your company. For more information, refer to Company details.
To retrieve and download quarantined files you must meet the following conditions:
Your account requires Manage Networks and Manage Company rights.
Your account must have two-factor authentication enabled.
You can retrieve a single file at a time.
The file size must not exceed 25 MB.
You can have a maximum of 10 retrieved files per company.
The files must be located on endpoints with Windows or macOS operating systems.
To retrieve and download a quarantined file on your computer follow the steps below:
Go to the Quarantine page.
Choose Computers and VMs.
Select a single file of interest from the table.
Click the Retrieve button from the upper side of the page.
In the new window, enter a name for the archive and a password to protect it.
Read and agree to the presented terms.
Click the Retrieve. button. A new task is created in the Tasks section.
Once the file is successfully retrieved, on the Quarantine page click the
vertical ellipsis button at the right end of the grid entry.Select the option Download retrieved file. The download process begins automatically.
Note
A retrieved file is available for download within 24 hours after which it is automatically deleted and requires a new retrieve action.
You can delete retrieved files whenever necessary. This enables you to begin a new retrieve action for a specific file or decrease the number of retrieved files in cases where your company file limit was reached.
To manually delete a retrieved file follow the next steps:
On the Quarantine page, go to the retrieved file.
Click the
vertical ellipsis button at the right end of the grid entry.Select the option Delete retrieved file. The retrieved file is deleted and you can start a new retrieve action if necessary.
Submitting retrieved files to Sandbox Analyzer
You can submit previously retrieved files to Sandbox Analyzer for an in-depth behavioral analysis. To retrieve quarantined files, refer to Retrieving and downloading quarantined files.
To submit a retrieved file to Sandbox Analyzer follow the steps below:
On the Quarantine page, go to the retrieved file.
Click the
vertical ellipsis button at the right end of the grid entry.Select the option Submit to Sandbox Analyzer. You will be redirected to the Manual Submission section.
Enter the password used when retrieving the file.
Configure the rest of the settings as desired.
Click Submit.
The analysis may take a few minutes. You can view the output as a new entry on the Sandbox Analyzer page. For more information, refer to Analyzing threats in sandbox.
Automatic deletion of quarantined files
By default, quarantined files older than 30 days are automatically deleted. This setting can be changed by editing the policy assigned to the managed endpoints.
To change the automatic deletion interval for quarantined files:
Go to the Policies page.
Find the policy assigned to the endpoints on which you want to change the setting and click its name.
Go to the Antimalware > Settings page.
In the Quarantine section, select the number of days after which files are being deleted.
Click Save to apply changes.
Manual deletion of quarantined files
If you want to manually delete quarantined files, you should first make sure the files you choose to delete are not needed.
A file may actually be the malware itself. If your research leads you to such a situation, you can search the quarantine for the specific threat and delete it from the quarantine.
To delete one or more quarantined files:
Go to the Quarantine page.
Select Computers and VMs.
Select the check boxes corresponding to the quarantined files you want to delete.
Click the Actions button at the upper side of the table and select Delete. Click Yes to confirm your action.
You can notice the pending status in the Action status column.
The requested action is sent to the target network objects immediately or as soon as they get back online. Once a file is deleted, the corresponding entry will disappear from the Quarantine table.
Emptying the quarantine
To delete all the quarantined objects:
Go to the Quarantine page.
Select Computers and VMs.
Click the Actions button and select Empty Quarantine.
In the confirmation window, select the option Include sub-companies quarantine to also delete the quarantined objects for your child companies, and click Delete.
All the entries from the Quarantine table are cleared. The requested action is sent to the target network objects immediately or as soon as they get back online.