During an investigation, when a threat in a quarantined endpoint is eradicated or dismissed as non-malicious, you can reconnect the endpoint to the network by ending the quarantine state.
Important
Make sure Enable Plug-in is selected on the Network Flow policy page for quarantine and end quarantine to work on the endpoint.
On the Monitoring dashboard, you can see a biohazard icon to the left of the endpoint name indicates that it is quarantined.
Enable Display Message on Quarantine actions on the Network Flow policy page to send a notification to the user. A message notifies the user of the quarantine or end quarantine action and the end quarantine is maintained between rebooting and shutting down of the endpoint. The notification message is set by default but can be customized.
The End Quarantine Devices feature is supported on Windows and macOS endpoints.
You can end the quarantine device status remotely using these dashboards: