Skip to main content
File remediation automatically (or manually) quarantines or deletes files when they are associated with malicious detections. If a detection matches a verdict rule with file remediation actions configured, but file auto-remediation is disabled globally, the detection will be escalated to your team. Remediation is always enabled manually when reviewing a case and selecting Actions > Remediate or Release.
Auto-remediation is not performed for detections from beta integrations. If the detection is generated by a beta integration, Wirespeed will skip automatic remediation and escalate the case to your team instead. Manual remediation remains available.

​
Remediation Actions

Wirespeed can take the following actions to remediate a file:
  • Quarantine File — quarantine the file to prevent execution
  • Delete File — permanently delete the file from the endpoint (irreversible)
Which actions appear in the UI and run for a detection depend on the connected EDR integration and the actions selected on the matching verdict rule.
Delete File is irreversible. Use it only when you are certain the file should be permanently removed.

​
Release Actions

When a detection is resolved as benign, Wirespeed can automatically reverse file remediation:
  • Unquarantine File — release the file from quarantine
Delete File has no automatic release action.

​
ReversingLabs verification

Automatic file remediation and release require ReversingLabs enrichment to confirm file risk:
  • Auto-remediation requires ReversingLabs to classify the file as malware or a late stage tool
  • Auto-release requires a prior successful Wirespeed remediation and ReversingLabs to classify the file as benign
Manual remediation from the case Actions menu is still available when enrichment is pending.

​
Supported integrations

File remediation and release actions are available through connected EDR integrations, including: Each integration supports a subset of the actions above. For example, CrowdStrike supports delete and unquarantine; SentinelOne, Palo Alto Cortex, and Halcyon support quarantine and unquarantine; Microsoft supports quarantine. The Remediate or Release dialog only shows actions your connected integration can perform.