Quarantined Files

Last updated
Save as PDF

This page provides the ability to search for a specific user, or filter quarantined files. You can also preview or download a file in Quarantine to make a decision on whether to Delete or Restore it. When you select one or more files from this list, Restore or Delete buttons are enabled.

The Quarantined Files page is located at Incidents > Policy Incidents > Quarantined Files.

IMPORTANT: As of the Skyhigh CASB 4.0 release, newly quarantined items will not be added to this list. To see them, go to the Incidents > Policy Incidents page, and use the Items in Quarantine Saved View.

quarantined_files_3.9.2.png

On the Quarantined Files page, the following information and actions are available:

Search. Enter a username to search.
Filter. Select filters for Status, Application, Instance, Policy, or Response.
CSV. Click the button to generate a CSV file including the information from the table.
Edit Table Columns. Click to show or hide table columns.
Download File. Click the link in the File Name column to download the quarantined file from the hosting cloud service. (Skyhigh CASB never stores customer documents in our cloud.)
Restore. Select the checkbox for one or more files to enable the Restore button. When a file is restored, it is returned to its original location in the cloud service. This removes the warning message and sends an e-mail to the uploading user, informing them that their file has been removed from quarantine.
Delete. Select the checkbox for one or more files to enable the Delete button. This permanently deletes the file from the cloud service.

Quarantine Statuses

Limited Availability: Quarantine Unsuccessful is a Limited Availability feature. To enable the Quarantine Unsuccessful status, contact Skyhigh Support.

New. The file has been quarantined and requires review.
Pending. The file has been put in the queue to be restored or deleted.
Deleted. The file has been permanently removed from the cloud service provider.
Restored. The file has been restored to its original location, the tombstone has been removed, and an email was sent to the user.
Auto Restored. The file has been restored automatically based on Auto Restore settings and an email was sent to the user.
Processing. The quarantine is still in process.
Failed. Restore or delete operation failed due to a service disruption, connectivity issues, etc.
Quarantine Unsuccessful. Skyhigh CASB could not quarantine a file even after multiple attempts. This could be caused by:
- A user is editing the document, so the file is locked and cannot be quarantined by Skyhigh Security.
- Data retention is enabled in Microsoft Office 365, and that is preventing Skyhigh Security from quarantining or deleting the data.

NOTE: By default, Skyhigh CASB makes a single attempt to quarantine a file. If you want Skyhigh CASB to make multiple attempts to quarantine a file, contact Skyhigh Support.

KNOWN ISSUE: For policies that use the Quarantine response action, Skyhigh CASB needs access to copy, update, and delete files from the folders. If the retention policy is enabled on the SharePoint site or list, we can’t delete the file or its contents. To fix this issue, remove the Quarantine response action from the policy or remove the retention policy from the SharePoint site.