When the Host Sensor quarantines a file, it encrypts the file, and stores it locally. The encrypted file remains on the host for the number of days specified in the Age Off For Quarantined Files setting. If you decide that a quarantined file does not represent a threat, you can remove the file from quarantine for up to 60 days, as long as the quarantined file remains on the host. For more information, see Remove a File from Quarantine.
To configure the Age Off For Quarantined Files setting:
- Log In to the TDR Web UI as an Administrator or Analyst.
- Select Configuration > Host Sensor.
- In the Configuration section, from the Age Off For Quarantined Files drop-down list, select the number of days the encrypted file remains on a host after it has been quarantined.
To specify that Host Sensors cannot delete quarantined files, select Never.
- Click Save.