topic Quarantine: Not seen shows in Endpoint Security

amp for endpoint cloud

ring zer0 — Fri, 21 Feb 2020 05:02:11 GMT

In AMP for endpoint dashboard in Detections/Quarantine. I see some items as "Quarantine: Not seen". What does not seen mean over here

This indicates that the

aledipas — Wed, 05 Oct 2016 12:17:16 GMT

This indicates that the quarantine action did not take place. The primary cause for this event is when the FireAMP connector is configured in Audit Mode. FireAMP is detecting a malicious file, but is not permitted to quarantine it per the policy settings. In rarer cases this can be caused by race conditions with co-existing AV or security products, but this case is more likely to produce a Quarantine: Failed event.

Quarantine: Not seen shows

syeda3 — Fri, 03 Feb 2017 15:32:40 GMT

Quarantine: Not seen shows that the quarantine action did not take place. In Audit mode it puts the FireAMP Connector in a mode that will only detect malicious files but not quarantine them. Malicious network traffic is also detected but not blocked.

Pleasee see the below url for the creation of policies on page 15.

http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/fireamp/fireamp-cloud/FireAMPDeploymentStrategy.pdf

Hope to help.