Understanding Quarantine

Quarantine is a storage area on endpoints that isolates infected and suspicious files that cannot be cleaned or deleted at time of detection. Files are prevented from running through encryption, which counters any threats posed by viruses and malware.
The types of files sent to quarantine, when Attempt to clean then quarantine (default) or Attempt to clean then quarantine then delete are set during scan configuration, are:
When a file that needs to be isolated is detected, it is moved to the endpoint’s \LMAgent\Data\persist\AV\quarantine folder and a Virus and Malware Event Alert of "Quarantined" is generated. Quarantined files can be viewed and managed in two ways:
On the Endpoint Quarantine pane of the Agent Control Panel. Actions that can be performed are :
Delete
Removes the infected file permanently from the endpoint.
Save As
Enables you to move a file back to its original location or another location (for example, for submitting to Ivanti for analysis). Choose this action for a file you believe was incorrectly detected as infected.
On the Ivanti Device and Application Control Console Centralized Quarantine page provides a network-wide view of all files quarantined on endpoints. Actions that can be performed are:
Scan now
Runs an immediate AntiVirus scan on the endpoints you select.
Delete
Removes the infected file permanently from the endpoints you select.
Restore
Move a file back to its original location on the endpoints that you select.

AntiVirus scans quarantined files after each virus definition update. Cleaned files are automatically moved back to their original location, if no file with the same name is already present.

Quarantine related activity can be viewed on the Endpoints with Unresolved AV Alerts dashboard widget, which displays the number of endpoints with unresolved AntiVirus event alerts. There are two types of unresolved antivirus event alerts: not cleaned and quarantined.

Related Information:
Centralized Quarantine
Related Tasks:
Viewing Files in Quarantine
Restoring a File from Quarantine
Deleting a File from Quarantine
Deleting Files from Quarantine Automatically