Skip to main content
dariopalermo
New Member
November 27, 2017
Question

How to work with alerts and quarantine

  • November 27, 2017
  • 1 reply
  • 2399 views

Hi guys, I'm new to FortiClient and EMS and I'm lost. In any security system I've seen in the past:

1) I could acknowledge alerts

1) I could delete or recover quarantine files

 

Now in my brand new EMS I've got this client with 5 AV alerts and I cannot clear them up. If I go on the client and open the local FortiClient console, I found 6 threats (not 5) and 1 quarantined file (no info on the other threats). Delete and restore buttons grayed out. And I logged on the machine as a local Administrator.

 

What does I have to do to recover that file? (it's a false positive, identified as PossibleThreat)

 

thanks

 

Bye, Dario

    1 reply

    Boris_Rogalla
    New Member
    December 5, 2017

    Hi dariopalermo,

     

    I'm sorry not to be able to offer help, but I want to add a +1

    as I am asking myself exactly the same questions.

     

    We are evaluating EMS and Forticlient and have several Clients with false positives.

    I have no idea how to manage this possible threads in EMS or on the client.

     

    I can only hope it's a GUI-bug.

    maybe someone can help?

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!