How do I restore encrypted files from quarantine?

Views:

Restore files encrypted and quarantined by the Trend Vision One Endpoint Security agent.

WARNING

Restoring an infected file can spread the virus/malware to other files and computers. Before restoring the file, isolate the infected endpoint and move important files on this endpoint to a backup location.

You can view, manage, and restore quarantined files using Endpoint Event Viewer. Use the following steps to collect or restore quarantined files.

Procedure

In the Trend Vision One console, go to Endpoint Security → Endpoint Event Viewer and access the Anti-Malware event list.
Enable Identified file event view.
Locate and select the file event that contains the quarantined file you want to restore.

You can select multiple file events to delete, collect, or restore quarantined files.

Choose the Response action to take.

To restore files, click Restore quarantined files.
To collect and download files locally, click Collect quarantined files.
To delete files, click Delete quarantined files.

Endpoint Event Viewer creates a Response task request to perform the selected action. You can view the task progress in Response Management.

If you chose Collect quarantined files, you can download the collected ZIP package from Response Management. The package is encrypted and requires using the password provided when you download the package.

Note

If you have determined the file to be safe, create an exception for the file before restoring to prevent the Trend Vision One Endpoint Security agent from quarantining the file again. You can create file exceptions using file lists in Policy Resources. For more information, see File Lists.