Menu

Join the Conversation

To sign in, use your existing MySonicWall account. To create a free MySonicWall account click "Register".

Sign In Register

Restore file from quarantine

FFGFFG Newbie ✭
edited February 2021 in Capture Client

We are deploying SonicWall Capture clients and on one of the Endpoints CC found malware. After reviewing I found out that is was a false positive and marked the threat as benign and added the file hash as exclusion.

I assumed the original file was automatically restored .. but it wasn’t 😐

The applied action for the threat was "Kill and Quarantine" .. so in my opinion the file should still be in quarantine on the Endpoint?! .. but how can I restore this?

When I open the threat there is an option to download the threat file .. but when the password protected ZIP file is created it only contains a JSON file and not the effected file?

HELP!!!

Category: Capture Client
Reply

Comments

  • SuroopMCSuroopMC SonicWall Employee

    @FFG - do you see the option to Unquarantine on the Threat page? See screenshot below.

    image.png


  • FFGFFG Newbie ✭

    No .. this option is not available:

    image.png


  • SuroopMCSuroopMC SonicWall Employee

    @FFG - I would recommend working with Support. They will need to determine what the current status of the threat and quarantined file is. To troubleshoot this further, they will need more information which obviously cannot be shared on this forum.

Sign In or Register to comment.