07-15-2019 09:25 AM - edited 02-20-2020 09:09 PM
Hello!
I would like to know why when I use a custom detection to quarantine a file, that file won't go to the quarantine folder and doesn't show me that the file was quarantined.
Even when I try to open the file again, the AMP shows me "not quarantined"
So, is it possible to quarantine a file using Audit policy for instance?
Because looks like is not.
Solved! Go to Solution.
07-15-2019 10:00 AM
07-15-2019 10:00 AM
07-15-2019 10:58 AM
Hi,
Yeah, I did it but didn't work in that time.
But I think it's another problem.
I'm facing today a problem of delay on AMP.
Some events were reported later. So I think that the manual quarantine didn't work because of that, maybe the event will be reported later.
Anyway, thanks for your help
07-15-2019 12:07 PM
You mentioned using an Audit Policy. The file won't be quarantined if you're using an Audit policy, you will just get a notification that it would have been quarantined if the policy was set up to do so.
07-15-2019 12:29 PM
So, is it not possible to manual quarantine a file if you are using an Audit policy?
I know that automatic quarantine in a Auditi policy doesn't work, but I thought that you could do that manually.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide