The Quarantined Files page is located at Incidents > Policy Incidents > Quarantined Files.
IMPORTANT: As of the McAfee MVISION Cloud 4.0 release, newly quarantined items will not be added to this list. To see them, go to the Incidents > Policy Incidents page, and use the Items in Quarantine Saved View.
This page provides the ability to search for a specific user, or filter quarantined files. You can also preview or download a file in Quarantine to make a decision on whether to Delete or Restore it. When you select one or more files from this list, Restore or Delete buttons are enabled.
On the Quarantined Files page, the following information and actions are available:
- Search. Enter a username to search.
- Filter. Select filters for Status, Application, Instance, Policy, or Response.
- CSV. Click the button to generate a CSV file including the information from the table.
- Edit Table Columns. Click to show or hide table columns.
- Download File. Click the link in the File Name column to download the quarantined file from the hosting cloud service. (MVISION Cloud never stores customer documents in our cloud.)
- Restore. Select the checkbox for one or more files to enable the Restore button. When a file is restored, it is returned to its original location in the cloud service. This removes the warning message and sends an e-mail to the uploading user, informing them that their file has been removed from quarantine.
- Delete. Select the checkbox for one or more files to enable the Delete button. This permanently deletes the file from the cloud service.
- New. File has been quarantined and requires review.
- Pending. File has been put in the queue to be restored or deleted.
- Deleted. File has been permanently removed from the cloud service provider.
- Restored. File has been restored to its original location, the tombstone has been removed, and an email was sent to the user.
- Auto Restored. File has been restored automatically based on Auto Restore settings and an email was sent to the user.
- Processing. The quarantine is still in process.
- Failed. Restore or delete operation failed due to a service disruption, connectivity issues, etc.
- Quarantine Unsuccessful. MVISION Cloud could not quarantine a file even after multiple attempts. This could be caused by:
- A user is editing the document, so the file is locked and cannot be quarantined by McAfee Enterprise.
- Data retention is enabled in Microsoft Office 365, and that is preventing McAfee Enterprise from quarantining or deleting the data.