The Cloud Storage Quarantine page displays quarantined files from your cloud storage providers and allows you to manage them.
To allow Cloud Storage Scanning to quarantine found threats automatically, toggle on the Enable Quarantine toggle in the Cloud Storage Scan configuration. For more information, see the following links:
- Configure Cloud Storage Scanning for Box in Nebula
- Configure Cloud Storage Scanning for OneDrive in Nebula
- Configure Cloud Storage Scanning for Google Drive in Nebula
On the left navigation menu, go to Monitor > Cloud Storage Quarantine to view the following information for each quarantined item:
- File Name: Name of the file that was quarantined.
- Found date: Date the file was detected.
- Location found: Location the file was detected.
- Owner: Original user to upload the quarantined file.
- Provider: Cloud storage provider where the file was detected.
- Quarantine location: Location of the quarantined file.
- Threat Name: Threat name of the quarantined file.
Once a file is deemed malicious, it is replaced by a tombstone file, and the malicious file is sent to the configured quarantine folder. The purpose of the tombstone file is to alert the user that the file has been quarantined and advises the user to contact their cloud administrator for additional questions.
If the quarantined file is a false positive, select it and go to Actions > Restore. This will place the file back in its original location and restore access to any collaborators or users with the share link. Restored files are not scanned again until the file hash changes.
NOTICE - For OneDrive, previously shared links remain expired after the file is restored. A new link must be generated and shared again.
To delete the file from quarantine, go to Actions > Delete. The file is sent to the administrator's trash in the cloud storage provider. If the file was deleted by mistake, go to the administrator's trash in the cloud storage provider and restore it from trash. Files in the trash may be deleted permanently after a set amount of time. Reference your cloud storage provider's settings to configure that time.
Return to Malwarebytes Cloud Storage Scanning guide.