AMP Endpoint scanning its own quarantine????

[Steve Bellan]

I thought by default it did not scan its own quarantine folder. We are getting a lot of alerts from this. No big deal if we have to add to exclusions manually, just making sure not missing something. 

[nspasov]

Can you:

1. Post the exact path that the alert is coming from

2. Screenshot of the notification

Thank you for rating helpful posts!

[Matthew Franks]

Steve,

This could happen if you've created a new policy and didn't include the default exclusion set.  By default, AMP does not scan its own directories, but it could if those exclusions were removed.

-Matt