Cisco AMP making reports for itens already in quarantine.

[Mateus Biscardi]

Hello everybody, everyday when I access my Cisco AMP tool I find some case where the file that is alerting has been already been put in quarantine before.

I imagine that I must been doing something wrong in my exclusion list or some similar mistake.

Can someone help me with this problem?

[Matthew Franks]

Could you provide more information on what you mean with a screenshot?

[Mateus Biscardi]

Hi Matthew, basically what is happening is that I receive some alerts in the endpoint but when I see the path the file is already in the quarantine.

I'll try to send here some screenshots

[Matthew Franks]

Most likely what is happening is that Secure Endpoint attempts to quarantine a file but the parent process (Chrome for example if it is being downloaded from a browser) still has a handle on it.  This would trigger a Quarantine Failure event since we are not able to quarantine the file at that time.  Then, as soon as the handle is available, we are able to quarantine the file successfully so you will also have a corresponding Quarantine Success event.

[Mateus Biscardi]

Thank you for your explanation Matthew, that is any secure way that I can prevent my AMP for reporting this type of notification ?

[Matthew Franks · Accepted solution]

Considering it is a legitimate alert at the time it occurs, not really.  One potential I see is if you set up a script to use an event stream, look for events on the same hash and mark them as quarantined in your output.  You can find a starter script for event streams here.

[Mateus Biscardi]

OK, thank you very much