amp for endpoint cloud

[ring zer0]

In AMP for endpoint dashboard in Detections/Quarantine. I see some items as "Quarantine: Not seen". What does not seen mean over here

[aledipas]

This indicates that the quarantine action did not take place. The primary cause for this event is when the FireAMP connector is configured in Audit Mode. FireAMP is detecting a malicious file, but is not permitted to quarantine it per the policy settings. In rarer cases this can be caused by race conditions with co-existing AV or security products, but this case is more likely to produce a Quarantine: Failed event.

[syeda3]

Quarantine: Not seen shows that the quarantine action did not take place. In Audit mode it puts the FireAMP Connector in a mode that will only detect malicious files but not quarantine them. Malicious network traffic is also detected but not blocked.

Pleasee see the below url for the creation of policies on page 15.

http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/fireamp/fireamp-cloud/FireAMPDeploymentStrategy.pdf

Hope to help.