How To Unquarantine Devices

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

To take sensors out of quarantine mode

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Versions
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions

Resolution

From Endpoints page

1. Search for Device(s) to unquarantine
2. Select desired Device(s)
3. Click Take Action > Unquarantine devices
4. Unquarantine device confirmation window appears
5. Select desired option

   Unquarantine the # selected devices
   Unquarantine all # devices matching the search

6. Click Yes

From Investigate page

1. Select an Event
2. Click on the Device tab on upper sub-menu
3. Click the Take Action > Unquarantine device
4. Unquarantine device confirmation window appears

   Are you sure you want to unquarantine device {DeviceName}

5. Click Request Unquarantine

Additional Information

• There is not currently a method to remove devices from quarantine locally (without the console).
• If a sensor stops talking to the backend after being quarantined it can be put into bypass locally to try to get it to talk to the backend.