diff --git a/docs/getting-started/configure-integration-policy.asciidoc b/docs/getting-started/configure-integration-policy.asciidoc index f9538cc415..255dd9b29e 100644 --- a/docs/getting-started/configure-integration-policy.asciidoc +++ b/docs/getting-started/configure-integration-policy.asciidoc @@ -90,8 +90,8 @@ The quarantine folder location varies by operating system: - macOS: `/System/Volumes/Data/.equarantine` - Linux: `.equarantine` at the root of the mount point of the file being quarantined -- Windows - {elastic-defend} versions 8.5 and later: `[DriveLetter:]\.quarantine`, unless the files are from the `C:` drive. These files are moved to `C:\Program Files\Elastic\Endpoint\state\.equarantine`. -- Windows - {elastic-defend} versions 8.4 and earlier: `[DriveLetter:]\.quarantine`, for any drive +- Windows - {elastic-defend} versions 8.5 and later: `[DriveLetter:]\.equarantine`, unless the files are from the `C:` drive. These files are moved to `C:\Program Files\Elastic\Endpoint\state\.equarantine`. +- Windows - {elastic-defend} versions 8.4 and earlier: `[DriveLetter:]\.equarantine`, for any drive To restore a quarantined file to its original state and location, <> to the rule that identified the file as malicious. If the exception would've stopped the rule from identifying the file as malicious, {elastic-defend} restores the file.