Quarantine and restoration
Preserve artifact identity, verify quarantine execution, and restore only after a new authorization.
Quarantine restricts access to a supported endpoint artifact and records its identity for investigation. It is separate from copying evidence to the control plane or backing up an application.
Quarantine an artifact
At Incident → Response → Request action → Quarantine artifact, select the endpoint and the observed artifact reference. Review its full path, SHA-256 digest, size, detection, and collection time. A path alone can refer to a different file by execution time; the agent checks the expected digest and reports artifact_changed if it no longer matches.
The action requires the target's quarantine capability and response authorization. Success means the agent acknowledged the protected local artifact record; it does not mean a raw sample was uploaded. Open Endpoints → Quarantine → Item for the original identity, current location state, action ID, and retention deadline.
A process might still hold an open file or have executed related code before quarantine. Verify process and persistence findings separately. Endpoint isolation and artifact quarantine have different effects and neither automatically performs the other.
Review and restore
Collect a sample only with evidence permission through Quarantine item → Collect evidence. Limit access and avoid downloading a suspicious artifact to an ordinary workstation.
To restore, choose Quarantine item → Request restoration, enter the review reason and approved destination, and obtain required approval. The agent verifies the stored artifact's digest and checks destination conflicts. An existing different file produces destination_conflict; it is not silently overwritten. Inspect the response result and local file state before declaring restoration complete.
An active blocking rule can quarantine the restored artifact again. Review its policy or approved exception before release, without weakening unrelated controls. Restoration cannot execute if the local quarantine store was lost, the device was wiped, or the item was already purged; an evidence export does not automatically supply a safe restoration source.
Retention and purge
Review Quarantine → Retention before approving automatic purge. A hold manager uses Quarantine item → Retention → Hold to request local preservation. The hold becomes effective when the agent acknowledges it; an offline device cannot confirm preservation. A pending hold does not establish that the artifact still exists.
Acknowledged holds block ordinary local cleanup until an authorized release is applied. Retiring an offline endpoint does not prove its local artifacts were removed. Reconcile or explicitly record unrecoverable local state. Centrally collected evidence follows its own retention and hold rules.