topic Re: Extract files from quarantine in Endpoint

Extract files from quarantine

Sec-ref — Mon, 14 Nov 2022 14:04:56 GMT

Hi,

is it possible to extract the file sent to the quarantine on the device in which the "Smart Endpoint" console is running? The version is 80.30.

-Is it correct to use that console?

-What are the technical steps to do it?

-Is it required a specific profile for the user in terms of privilege?

The objective is to get the file in order to analyze it with external products.

Thanks,

R. R.

Re: Extract files from quarantine

PhoneBoy — Mon, 14 Nov 2022 14:35:18 GMT

Did you try: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk162553&partition=Basic&product=Endpoint#Viewing%20Quarantined%20Items

Re: Extract files from quarantine

Sec-ref — Wed, 16 Nov 2022 09:25:37 GMT

Hi,

from that document it seems that the action is going to restore the file on the server in which it was, and not on the server in which the Checkpoint console is running. Probably the only solution is to define a central location on which copy all quarantined files, as shown on the image of this thread:

Accessing Quarantined Files - Check Point CheckMates

Regards,

R. R.