From 454a2d0e5b8f79579f0d8ef436b413b08fd32c6d Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic Date: Thu, 13 Aug 2026 09:37:02 +0100 Subject: [PATCH 1/2] [Security] Fixes Windows quarantine path for Elastic Defend Co-authored-by: Cursor --- .../configure-an-integration-policy-for-elastic-defend.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md b/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md index e5ae9f1cdf..9d7ed73a8f 100644 --- a/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md +++ b/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md @@ -137,8 +137,9 @@ The quarantine folder location varies by operating system: * macOS: `/System/Volumes/Data/.equarantine` * Linux: `.equarantine` at the root of the mount point of the file being quarantined -* Windows - {{elastic-defend}} versions 8.5 and later: `[DriveLetter:]\.equarantine`, unless the files are from the `C:` drive. These files are moved to `C:\Program Files\Elastic\Endpoint\state\.equarantine`. -* Windows - {{elastic-defend}} versions 8.4 and earlier: `[DriveLetter:]\.equarantine`, for any drive +* Windows: + * Quarantined file: `[DriveLetter:]\.equarantine` on the same volume as the original file (for example, `C:\.equarantine`) + * Quarantine metadata (`.mdata`) and the quarantine state file: `C:\Program Files\Elastic\Endpoint\state\.equarantine` for files from every volume To restore a quarantined file to its original state and location, [add an exception](/solutions/security/detect-and-alert/add-manage-exceptions.md) to the rule that identified the file as malicious. If the exception would’ve stopped the rule from identifying the file as malicious, {{elastic-defend}} restores the file. From eed6034bf978ba063437ab63d8080ce593de3764 Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> Date: Tue, 18 Aug 2026 08:27:00 +0100 Subject: [PATCH 2/2] Update solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md Co-authored-by: Brandon Morelli --- .../configure-an-integration-policy-for-elastic-defend.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md b/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md index 9d7ed73a8f..bcb7d54a9b 100644 --- a/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md +++ b/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md @@ -139,7 +139,7 @@ The quarantine folder location varies by operating system: * Linux: `.equarantine` at the root of the mount point of the file being quarantined * Windows: * Quarantined file: `[DriveLetter:]\.equarantine` on the same volume as the original file (for example, `C:\.equarantine`) - * Quarantine metadata (`.mdata`) and the quarantine state file: `C:\Program Files\Elastic\Endpoint\state\.equarantine` for files from every volume + * Quarantine metadata (`.mdata`): `C:\Program Files\Elastic\Endpoint\state` for files from every volume To restore a quarantined file to its original state and location, [add an exception](/solutions/security/detect-and-alert/add-manage-exceptions.md) to the rule that identified the file as malicious. If the exception would’ve stopped the rule from identifying the file as malicious, {{elastic-defend}} restores the file.