Skip to main content
File remediation automatically (or manually) quarantines or deletes files when they are associated with malicious detections. If a detection matches a verdict rule with file remediation actions configured, but file auto-remediation is disabled globally, the detection will be escalated to your team. Remediation is always enabled manually when reviewing a case and selecting Actions > Remediate or Release.
Auto-remediation is not performed for detections from beta integrations. If the detection is generated by a beta integration, Wirespeed will skip automatic remediation and escalate the case to your team instead. Manual remediation remains available.

​
Remediation Actions

Wirespeed can take the following actions to remediate a file:
  • Quarantine File — quarantine the file to prevent execution
  • Delete File — permanently delete the file from the endpoint (irreversible)
Which actions appear in the UI and run for a detection depend on the connected EDR integration and the actions selected on the matching verdict rule.
Delete File is irreversible. Use it only when you are certain the file should be permanently removed.

​
Release Actions

When a detection is resolved as benign, Wirespeed can automatically reverse file remediation:
  • Unquarantine File — release the file from quarantine
Delete File has no automatic release action. Automatic release runs when a detection becomes benign at ingestion, from a ChatOps response, or when an analyst marks it benign. Ingestion and ChatOps skip it for test-mode detections, ChatOps tests, and reingested detections. Ingestion also skips historic detections that arrived after a significant upstream delay, and ChatOps waits for the responder to complete MFA. An analyst marking any of these detections benign still releases files Wirespeed quarantined. For test-mode, ChatOps-test, and reingested detections, the analyst release does not check for files the EDR quarantined itself.

​
Files the EDR quarantined itself

When SentinelOne quarantined a file on its own, before Wirespeed took any action, automatic release can still return it. When the detection arrives, Wirespeed records whether SentinelOne reported the file’s quarantine as successful and not since reversed. If it did, Wirespeed records the source-reported quarantine as release-eligible evidence, and release proceeds as it would for a file Wirespeed quarantined. This applies only when:
  • File Auto Release is enabled on the team
  • the matching verdict rule enables file uncontainment
  • SentinelOne reported the quarantine on the detection (EDR and Cloud Workload Security alerts)
  • the detection is linked to a single endpoint managed by the same SentinelOne integration
Wirespeed relies on the quarantine status reported when the detection arrived and does not check SentinelOne again before releasing. If the file was already released in SentinelOne, the unquarantine fails and is shown on the detection timeline. When File Auto Release is enabled and SentinelOne reported the quarantine, a file that does not meet the other conditions is left alone, with a note on the detection timeline. Detections without a reported quarantine get no note. If a benign release is refused while a file is still quarantined, Wirespeed adds a highlighted timeline entry with the reason and escalates the detection for manual review.

​
ReversingLabs verification

Automatic file remediation and release require ReversingLabs enrichment to confirm file risk:
  • Auto-remediation requires ReversingLabs to classify the file as malware or a late stage tool
  • Auto-release requires File Auto Release enabled on the team (off by default), file uncontainment enabled on the matching verdict rule, a prior successful Wirespeed remediation (or a SentinelOne quarantine reported on the detection, see Files the EDR quarantined itself), ReversingLabs to classify the file as benign, every scanner threat name to be empty, and a valid signing certificate
ReversingLabs results older than the enrichment cache window are treated as missing, so automatic release is refused rather than deferred. A refused release of a still-quarantined file is escalated for manual review. For SentinelOne, automatic release first creates a SHA-1 exclusion, waits for the exclusion to propagate, and then unquarantines the file. Wirespeed rechecks the ReversingLabs and containment facts before both provider actions.
The SentinelOne exclusion is not removed when the file is released. It stays in your SentinelOne console until you remove it there.
Manual remediation from the case Actions menu is still available when enrichment is pending.

​
Supported integrations

File remediation and release actions are available through connected EDR integrations, including: Each integration supports a subset of the actions above. For example, CrowdStrike supports delete and unquarantine; SentinelOne, Palo Alto Cortex, and Halcyon support quarantine and unquarantine; Microsoft supports quarantine. The Remediate or Release dialog only shows actions your connected integration can perform.