Quarantine Management
R81 Harmony Endpoint Server Administration Guide|330
Quarantine Management
When Harmony Endpoint components (Forensics and Anti-Ransomware, Anti-Bot, and Threat
Extraction and Threat Emulation), detect malicious files, they can quarantine those files
automatically based on policy. All components use the same Remediation service, that:
n
Receives the request to quarantine a file.
n
Terminates the file's process, if running.
n
Encrypts the file and stores it compressed along with metadata in a protected folder.
Two utilities let administrators and end-users manage quarantined files.
Harmony Endpoint Quarantine Manager
The Harmony Endpoint Quarantine Manager utility is called RemediationManagerUI.exe
and it is located in C:\Program Files (x86)\CheckPoint\Endpoint
Security\Remediation on client computers. It lets end-users:
n
See the files in quarantine
n
Delete the quarantined files
n
Restore files from quarantine.
Harmony Endpoint Quarantine Manager for Administrators
The administrator utility contains the capabilities of the end-user utility plus these additional
features:
n
Quarantine - Send files to quarantine.
n
Delete - Use the Harmony Endpoint Remediation service to delete a file.
n
Import - Import a quarantined file from a different computer or location.
Get the administrator utility from the release homepage.
Using the Quarantine Manager for Administrators
When you open the Harmony Endpoint Quarantine Manager or the Harmony Endpoint
Quarantine Manager for Administrators, each quarantined item is shown as a file. The name of
the file is the incident ID. To find a file, search for the incident ID found in the Harmony
Endpoint logs.
By default, quarantined files stored on the client are in
C:\ProgramData\CheckPoint\Endpoint Security\Remediation\quarantine on
the client computer.
To Next Page