Manage quarantined files ↗

When the agent detects malware on an endpoint, you can take additional precautions to quarantine the file. When the agent quarantines malware, it moves the file from the location on a local or removable drive to a local quarantine folder where it encrypts and isolates the file as a locked file. This prevents the file from attempting to run again from the same path or causing any harm to your endpoints. The file remains stored locally in this repository until explicitly restored or deleted, or until storage rotation occurs.

To evaluate whether an executable file is considered malicious, the agent calculates a verdict using information from the following sources in order of priority:

1. Hash exception policy
2. WildFire threat intelligence
3. Local analysis

Local quarantine folder location by OS

• Windows: %ProgramData%\PaloAltoNetworks\Traps\quarantine\ (or ...\Cortex XDR\quarantine\, depending on agent version)
• macOS: /Library/Application Support/PaloAltoNetworks/Traps/quarantine/ (or .../Cortex XDR/quarantine/) [Comment: Added macOS path from Text 2]
• Linux: /opt/traps/quarantine/ (or /var/log/traps/quarantine/)

How to quarantine a file in Cortex XSIAM

You can quarantine a file in the following ways:

• Enable the agent to automatically quarantine malicious executables by configuring quarantine settings in a Malware prevention profile. For more information, see Set up malware prevention profiles.
• Right-click a specific file from the causality view and select Quarantine.

Retention and Expiration Timeframes

• Quarantine List Retention: Quarantined file records remain in the Quarantine List for a default retention period of 180 days (6 months).
• Pending Action Expiration: When a Quarantine command is issued to an offline or unreachable endpoint, the command stays in Pending status for 4 days by default before expiring. This setting is configurable between 1 and 30 days.

To update the Pending Action Expiration setting, go to Settings → Configurations → Agent Configurations → Action Center Expiration and locate Quarantine under the Response category, modify the Expiration (Days) field, and click Save.

View and manage quarantined files

Requires the Cortex XSIAM Premium, Enterprise, or any other XSIAM license with the Enterprise Runtime Security or the Cloud Runtime Security add-on.

1. To view the quarantined files in your network, go to Investigation & Response → Response → Action Center → File Quarantine.

   Toggle between the Detailed and Aggregated By SHA256 tabs to see information on your quarantined files.

2. Review details about quarantined files.

   • In the Detailed view, filter and review the Endpoint Name, Domain, File Path, Quarantine Source, and Quarantine Date of all the quarantined files. You can take the following actions:

     • Reinstate a quarantined file: Right-click one or more rows and select Restore all files by SHA256.

       Note

       This will restore all files with the same hash on all of your endpoints.

       • Review the quarantined file inspection results on VirusTotal: Right-click the Hash field and select Open in VirusTotal.
     • Drill down on the hash value: Right-click the Hash field and select Open Hash View. You can see each of the process executions, file operations, cases, actions, and threat intelligence reports relating to the hash value.
     • Search for where the hash value appears in Cortex XSIAM: Right-click the Hash field and select Open in Quick Launcher.
     • Export to file: Click the icon on the top right corner to download a detailed list of the quarantined hashes in a TSV format.
   • In the Aggregated by SHA256 view, filter and review the Hash, File Name, File Path, and Scope of all the quarantined files. You can take the following actions:
     • Open the Quarantine Details page: Right-click a row and select Additional Data to open the page detailing the Endpoint Name, Domain, File Path, Quarantine Source, and Quarantine Date of a specific file hash.
     • Reinstate a file hash: Right-click and select Restore.
     • Permanently delete quarantined files on the endpoint: Right-click and select Delete all files by SHA256.