During an investigation, when a threat in a quarantined endpoint is eradicated or dismissed as non-malicious, you can reconnect the endpoint to the network by ending the quarantine state using the Investigating dashboard.
Important
Make sure Enable Plug-in is selected on the Network Flow policy page for quarantine and end quarantine to work on the endpoint.
The End Quarantine Device feature is supported on Windows and macOS endpoints.
Log on to Trellix EDR.
Select Menu → Investigating.
Open an existing investigation created and navigate to Investigated Items.
Click Investigated Items and select device(s).
A device detail appears on the right pane.
On the Finding details pane, click a hostname and select End Quarantine Device action from the Take action menu.
On the Action History dashboard, Action Status displays the end quarantine device status action as Completed.