> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# File Remediation

> Quarantine malicious files

File remediation automatically (or manually) quarantines or deletes files when they are associated with malicious detections. If a detection matches a verdict rule with file remediation actions configured, but file auto-remediation is disabled globally, the detection will be escalated to your team.

Remediation is always enabled manually when reviewing a case and selecting Actions > Remediate or Release.

<Info>
  Auto-remediation is not performed for detections from beta integrations. If the detection is generated by a beta integration, Wirespeed will skip automatic remediation and escalate the case to your team instead. Manual remediation remains available.
</Info>

## Remediation Actions

Wirespeed can take the following actions to remediate a file:

* **Quarantine File** — quarantine the file to prevent execution
* **Delete File** — permanently delete the file from the endpoint (irreversible)

Which actions appear in the UI and run for a detection depend on the connected EDR integration and the actions selected on the matching verdict rule.

<Warning>
  Delete File is irreversible. Use it only when you are certain the file should be permanently removed.
</Warning>

## Release Actions

When a detection is resolved as benign, Wirespeed can automatically reverse file remediation:

* **Unquarantine File** — release the file from quarantine

Delete File has no automatic release action.

## ReversingLabs verification

Automatic file remediation and release require [ReversingLabs](/integrations/reversing-labs) enrichment to confirm file risk:

* **Auto-remediation** requires ReversingLabs to classify the file as malware or a late stage tool
* **Auto-release** requires a prior successful Wirespeed remediation and ReversingLabs to classify the file as benign

Manual remediation from the case Actions menu is still available when enrichment is pending.

## Supported integrations

File remediation and release actions are available through connected EDR integrations, including:

* [Microsoft Defender for Endpoint](/integrations/microsoft)
* [CrowdStrike Falcon](/integrations/crowdstrike-falcon)
* [SentinelOne](/integrations/sentinel-one)
* [Palo Alto Networks Cortex](/integrations/palo-alto-networks-cortex)
* [Halcyon](/integrations/halcyon)

Each integration supports a subset of the actions above. For example, CrowdStrike supports delete and unquarantine; SentinelOne, Palo Alto Cortex, and Halcyon support quarantine and unquarantine; Microsoft supports quarantine. The Remediate or Release dialog only shows actions your connected integration can perform.