Skip to content

Commit 6e01499

Browse files
rseldnerjoepeeples
andauthored
[doc] Noted blocklisted files are quarantined (#5918)
* Update configure-integration-policy.asciidoc - Noted we quarantine blocklisted files Explicitly noted block listed files are quarantined * Fix typo * Apply change to serverless docs --------- Co-authored-by: Joe Peeples <[email protected]>
1 parent 632deff commit 6e01499

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

docs/getting-started/configure-integration-policy.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ image::images/install-endpoint/malware-protection.png[Detail of malware protecti
8484
[[manage-quarantined-files]]
8585
=== Manage quarantined files
8686

87-
When *Prevent* is enabled for malware protection, {elastic-defend} will quarantine any malicious file it finds. Specifically {elastic-defend} will remove the file from its current location, encrypt it with the encryption key `ELASTIC`, move it to a different folder, and rename it as a GUID string, such as `318e70c2-af9b-4c3a-939d-11410b9a112c`.
87+
When *Prevent* is enabled for malware protection, {elastic-defend} will quarantine any malicious file it finds (this includes files defined in the <<blocklist>>). Specifically {elastic-defend} will remove the file from its current location, encrypt it with the encryption key `ELASTIC`, move it to a different folder, and rename it as a GUID string, such as `318e70c2-af9b-4c3a-939d-11410b9a112c`.
8888

8989
The quarantine folder location varies by operating system:
9090

docs/serverless/edr-install-config/configure-endpoint-integration-policy.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ Endpoint Protection Complete customers can customize these notifications using t
103103

104104
### Manage quarantined files
105105

106-
When **Prevent** is enabled for malware protection, ((elastic-defend)) will quarantine any malicious file it finds. Specifically ((elastic-defend)) will remove the file from its current location, encrypt it with the encryption key `ELASTIC`, move it to a different folder, and rename it as a GUID string, such as `318e70c2-af9b-4c3a-939d-11410b9a112c`.
106+
When **Prevent** is enabled for malware protection, ((elastic-defend)) will quarantine any malicious file it finds (this includes files defined in the <DocLink slug="/serverless/security/blocklist">blocklist</DocLink>). Specifically ((elastic-defend)) will remove the file from its current location, encrypt it with the encryption key `ELASTIC`, move it to a different folder, and rename it as a GUID string, such as `318e70c2-af9b-4c3a-939d-11410b9a112c`.
107107

108108
The quarantine folder location varies by operating system:
109109

0 commit comments

Comments
 (0)