diff --git a/docs/getting-started/configure-integration-policy.asciidoc b/docs/getting-started/configure-integration-policy.asciidoc index f9538cc415..255dd9b29e 100644 --- a/docs/getting-started/configure-integration-policy.asciidoc +++ b/docs/getting-started/configure-integration-policy.asciidoc @@ -90,8 +90,8 @@ The quarantine folder location varies by operating system: - macOS: `/System/Volumes/Data/.equarantine` - Linux: `.equarantine` at the root of the mount point of the file being quarantined -- Windows - {elastic-defend} versions 8.5 and later: `[DriveLetter:]\.quarantine`, unless the files are from the `C:` drive. These files are moved to `C:\Program Files\Elastic\Endpoint\state\.equarantine`. -- Windows - {elastic-defend} versions 8.4 and earlier: `[DriveLetter:]\.quarantine`, for any drive +- Windows - {elastic-defend} versions 8.5 and later: `[DriveLetter:]\.equarantine`, unless the files are from the `C:` drive. These files are moved to `C:\Program Files\Elastic\Endpoint\state\.equarantine`. +- Windows - {elastic-defend} versions 8.4 and earlier: `[DriveLetter:]\.equarantine`, for any drive To restore a quarantined file to its original state and location, <> to the rule that identified the file as malicious. If the exception would've stopped the rule from identifying the file as malicious, {elastic-defend} restores the file. diff --git a/docs/serverless/edr-install-config/configure-endpoint-integration-policy.asciidoc b/docs/serverless/edr-install-config/configure-endpoint-integration-policy.asciidoc index 8c97fe6815..def6970348 100644 --- a/docs/serverless/edr-install-config/configure-endpoint-integration-policy.asciidoc +++ b/docs/serverless/edr-install-config/configure-endpoint-integration-policy.asciidoc @@ -107,8 +107,8 @@ The quarantine folder location varies by operating system: * macOS: `/System/Volumes/Data/.equarantine` * Linux: `.equarantine` at the root of the mount point of the file being quarantined -* Windows - {elastic-defend} versions 8.5 and later: `[DriveLetter:].quarantine`, unless the files are from the `C:` drive. These files are moved to `C:\Program Files\Elastic\Endpoint\state.equarantine`. -* Windows - {elastic-defend} versions 8.4 and earlier: `[DriveLetter:].quarantine`, for any drive +* Windows - {elastic-defend} versions 8.5 and later: `[DriveLetter:].equarantine`, unless the files are from the `C:` drive. These files are moved to `C:\Program Files\Elastic\Endpoint\state.equarantine`. +* Windows - {elastic-defend} versions 8.4 and earlier: `[DriveLetter:].equarantine`, for any drive To restore a quarantined file to its original state and location, <> to the rule that identified the file as malicious. If the exception would've stopped the rule from identifying the file as malicious, {elastic-defend} restores the file.