When the File ProtectFile Protect appliance analyzes a file it classifies as malicious, it can be automatically moved to a quarantine folder (also known as a "scan results location" or a "target share"). All quarantine folders are remote; they cannot be configured to reside on the File Protect appliance. These remote quarantine folders require write access from both the source file share and the File Protect appliance.
Caution
If you choose to configure a quarantine share for a scan, you can select either a quarantine share you added or "local_QF." If you select "local_QF," the File Protect appliance will create a local_QF folder in the source file share the first time it encounters a malicious file, and will move all malicious files into it. Trellix recommends against using "local_QF," because malicious files will not be isolated from the source files.
A quarantine folder can be mapped to any and all configured network shares, or each network share can have its own quarantine folder mapped to it. The name that you define for a quarantine folder is used to uniquely identify share mount points. Therefore, each quarantine folder name must be unique; it cannot be the same as the name of a configured network share or another quarantine folder.
If you configure only a quarantine folder for a scan (that is, you do not a configure good, unknown, or whitelist folder), when a file is quarantined, the File Protect appliance creates a reference-only file in the same location of the network share as the original file and appends fe-quarantined to the file name. For example, if the training.ppt file is malicious, it is moved to the quarantine folder. A reference-only file named training.ppt.fe-quarantined is added to the network share, with a file type of FE-QUARANTINED File, and a file size of 0 KB. In the quarantine folder, the file has the original name and size, and the file type becomes MALWARE File.
If you examine analysis results and then conclude that a quarantined file is non-malicious, you can release it from the quarantine folder. A released file is returned to its original network share location for full access and use, and ownership and permissions for the file are assigned to the user who released the file from the quarantine. The file is also put on an internal whitelist, so it will not be marked as malicious the next time it is analyzed. When you release a quarantined object, the MD5 checksum of the file is added to a whitelist to prevent the file from being quarantined on subsequent scans.
You can delete a file from the quarantine folder, which permanently removes it from both the network share and the quarantine folder. If you determine that an MD5 was detected as a false-positive event, you can suppress it from being marked as malicious. All records matching that MD5 will be marked as non-malicious.
The File Protect appliance provides detailed information about malicious files and the malware they contain.
The Show Quarantined Files page lists the malicious files that were quarantined after analysis. See Managing quarantines using the Web UI.
The File Analysis page provides details about the malware that was detected in quarantined files. See Viewing malware using the Web UI.
The show file-analysis CLI command displays malware statistics. See Viewing malware using the CLI.
The show submission CLI command displays statistics about the number of malware submissions that were analyzed and the number submitted per minute. The show submission malicious command displays statistics about the malware submissions that are marked as malicious. See Viewing malware submissions using the CLI.
For details about each show submission command, refer to the Trellix CLI Reference.