Cisco A4E - Restore not seen

[tom.power1]

Hi,

On an endpoint, I click to restore the quarantined files.  Afterwards I see the following message - Restore: Not Seen. The quarantined files are not restored.

What's the issue?

Thanks for your help.

Cheers.
Tom   

[Luis Velazquez]

Hi Tom,

This error happen when the quarantine file on the endpoint (In the folder "C:\Program Files\Cisco\AMP\Quarantine") is no longer there.

This could happen if the quarantine files were deleted manually by stopping the service and deleting the files, or if the file was quarantined more than 30 days ago, as AMP will only maintaining quarantined files for as long as 30 days.

Greetings,

Luis

[tom.power1]

Thanks Luis for the explanation.

That makes sense and it appears to be the case in this instance.
Have a great and thanks for the information.
Cheers.

Tom

[benrahal]

Hello , in This error see that the folder is empty (C:\Program Files\Cisco\AMP\Quarantine)