During an investigation, when a threat in a quarantined endpoint is eradicated or dismissed as non-malicious, you can reconnect the endpoint to the network by ending the quarantine.
Log on to Trellix EDR as administrator.
Select Menu → Monitoring.
In the Threats by Ranking / Threats by Time pane, select a threat to view the affected endpoints.
In the Device pane, select one or more affected endpoints to enable the Device Actions drop-down list.
From the Device Actions menu, select End Quarantine to end the quarantine process on one or more affected endpoints.
Click Confirm to complete the process.
You can check the action status to confirm that the End Quarantine action is completed:
In the Monitoring dashboard, refresh the endpoint list.
Note
When the endpoint is no longer in quarantine, the biohazard sign disappears.
In the Action History dashboard, the Action Status displays the End Quarantine action as Completed.