Kaspersky Endpoint Security for Linux

Managing the Quarantine

Quarantine is a special local storage on the device. You can quarantine files that you consider dangerous to your device. Quarantined files are stored in an encrypted form and do not threaten the security of the device. Quarantined files may contain personal data.

Some files can be critically important for the operation of the operating system and the application. Quarantining such files can disrupt the operation of the system.

The Kaspersky Endpoint Security application uses Quarantine only when integrated with the Detection and Response solutions: Kaspersky Anti Targeted Attack Platform and Kaspersky Endpoint Detection and Response Optimum. In other cases, Kaspersky Endpoint Security places the file in Backup.

When integrating with the Kaspersky Endpoint Detection and Response Optimum solution, you can configure the Quarantine file task in the Web Console. When integrating with the Kaspersky Endpoint Detection and Response (KATA) component, this task is configured in the Kaspersky Endpoint Detection and Response (KATA) component. For more information about managing Quarantine as part of solutions, see the Kaspersky Anti Targeted Attack Platform Help and Kaspersky Endpoint Detection and Response Optimum Help.

A file can be quarantined only if one of the following conditions is met: integration with the Kaspersky Endpoint Detection and Response Optimum solution is enabled and the Endpoint Detection and Response Optimum component is activated, or integration with the Kaspersky Endpoint Detection and Response (KATA) component is enabled and the Endpoint Detection and Response (KATA) component is activated. Restoring, deleting, and retrieving a file from quarantine in Kaspersky Security Center and in the command line is available regardless of whether integration with the Kaspersky Endpoint Detection and Response (KATA) component or the Kaspersky Endpoint Detection and Response Optimum solution is enabled, and regardless of whether the device is covered by a policy. Activating Endpoint Detection and Response Optimum and Endpoint Detection and Response (KATA) components also does not affect the ability to perform these actions.

The general list of files quarantined by Kaspersky applications on client devices is kept in Kaspersky Security Center and is available in the Administration Console (Advanced → Repositories → Quarantine) and the Web Console (Operations → Repositories → Quarantine). Kaspersky Security Center does not copy files from Quarantine storages to the Administration Server; all files are stored in Quarantine storages on client devices. In Kaspersky Security Center, you can view information about quarantined files located on client devices, delete and restore files from quarantine (for more details, see the Kaspersky Security Center Help).

To manage quarantined files in Kaspersky Security Center, you need to enable the transfer of data about quarantined files to the Administration Server.

You can also work with quarantined files locally on the device using the command line. You can view information about quarantined files, and delete and restore files from quarantine.

The directory for storing quarantined files must be writable.

The quarantined file is restored to its original location according to the specified settings. Once the restoration process is complete, the application deletes the quarantined copy of the restored file.

Restoring a file from quarantine fails in the following cases:

• The file to be restored was not found in the quarantine storage.
• The name of the file being restored is specified incorrectly or with the wrong case.
• The file ID was specified incorrectly.
• The destination folder has been deleted, moved, renamed, or you do not have access rights to it.

  In this case, the application moves the file to the folder /var/opt/kaspersky/kesl/common/restored/. You can manually move the file from this folder to the desired folder.

• A file with the same name already exists at the specified path.
• The device does not have enough space.

Deleting a file from quarantine fails in the following cases:

• The file to be deleted was not found in the quarantine storage.
• The name of the file being deleted is specified incorrectly or with the wrong case.
• The file ID was specified incorrectly.

You can configure quarantine settings on a device using a policy in the Web Console or in the Administration Console or using the command line. You can configure the following Quarantine settings:

• The percentage of Quarantine that must be full to generate an event about Quarantine being full. By default, an event is generated when the Quarantine is 90% full.
• Maximum size of the Quarantine in megabytes. When the maximum Quarantine size is reached, the application automatically deletes the oldest quarantined files. By default, the maximum Quarantine size is 200 MB if the application is being used in Standard mode, and 100 MB if the application is being used in Light Agent mode.