Quarantine and Severity

Not every bad file is bad in the same way. An .exe inside a TV download is unambiguously malicious; a .rar is how a large share of legitimate releases ship. Treating both as equally deserving of deletion is what makes automatic remediation feel risky.

Severity grades each finding. Quarantine gives the middle ground a place to go.

---

Severity

Every condition that fires produces a finding, and each finding is graded independently. A single file can produce more than one — keygen.exe trips both bad_extensions and a bad_filename_patterns match, and each is graded on its own.

Built-in grades

Finding	Severity
Executable or script extension (.exe .bat .msi .js .vbs .dmg .scr .lnk .jar …)	CRITICAL
Archive extension (.zip .rar .7z .iso .cab …)	HIGH
Primary file below min_file_size_mb	HIGH
Filename pattern match	MEDIUM
Any other flagged extension	MEDIUM

The worst finding wins

A torrent's overall risk is the maximum of its findings, never an average. One executable among twenty routine findings is still an executable — averaging would bury it.

A risk_score (0–100) is also recorded, but it exists for display and sorting only. The level is what decides the outcome; the score can never promote a finding into a higher band.

Overriding a grade

If an extension is normal in your library, reclassify it. Extension keys win over signal keys.

remediation:
  severity_overrides:
    ".rar": LOW                    # RAR is routine here
    ".iso": CRITICAL               # but a disc image never is
    "bad_filename_pattern": LOW    # trust your own patterns less

Edit these in Settings → Rules → Raw YAML; the pane exposes the thresholds but not the override map.

---

The three bands

Two thresholds split severity into three outcomes.

risk < min_severity                    ->  recorded only, no action
min_severity <= risk < remediate_at    ->  QUARANTINED (paused, held)
risk >= remediate_at                   ->  blocklisted and deleted

Both default to LOW, which collapses the quarantine band to nothing: everything flagged is deleted immediately. That is the behaviour Inspectarr has always had, and it does not change until you raise remediate_at.

Configure both under Settings → Rules → Remediation & Severity. The page shows the resulting bands as you change them.

A worked example

With the default extension list [.exe, .zip, .bat, .msi, .js, .vbs, .dmg, .rar]:

remediate_at	.exe .bat .msi .js .vbs .dmg	.zip .rar
LOW (default)	deleted	deleted
CRITICAL	deleted	quarantined

Raising it to CRITICAL means executables are still removed on sight, while archive-only matches wait for you to look.

---

Quarantine

A quarantined torrent is paused and listed on the Quarantine page awaiting a decision. Nothing is deleted and nothing expires unless you configure a timeout.

Quarantine involves no AI. Severity is entirely deterministic.

Your three choices

Action	What happens
Release	The torrent is resumed and the hold cleared. Use when it was a false positive.
Keep paused	The hold is closed but the torrent stays paused. Use when you want it stopped without deleting it.
Delete	Blocklisted in the *arr and removed from the torrent client — the same remediation that would have happened automatically. Asks for confirmation.

An action only resolves the hold once the underlying operation succeeds. If the torrent client refuses to resume, the entry stays held and visible rather than silently vanishing from the queue while still paused.

If the pause fails

Inspectarr pauses first, but does not abandon the hold if the client refuses — the torrent still needs a decision. The entry is flagged not paused on the Quarantine page, because a torrent that is still downloading should not be presented as contained.

Timeouts

By default a hold waits indefinitely. Set a timeout only if you want holds to resolve themselves.

remediation:
  quarantine_timeout_minutes: 0        # 0 = hold indefinitely (default)
  quarantine_timeout_action: release   # "release" or "remediate"

The default action is release because an expiring timer means nobody looked — which is not the same as deciding the release was malicious. Choosing remediate is an explicit decision to let a timer delete.

If a timed-out deletion fails, the entry stays held rather than being marked deleted.

---

What gets recorded

Every flagged release writes an inspection record regardless of the band, including catches below min_severity that are never acted on. Each record stores the aggregate risk level, the decision, and one row per finding with its own severity — so months later you can still see exactly what was seen and why it was handled that way.

Events written to the log: torrent_quarantined, quarantine_released, quarantine_kept, quarantine_remediated, quarantine_timeout_released, quarantine_timeout_remediated, below_severity_floor.

---

Related

• Rules — the conditions that produce findings
• Detection & Actions — the full scan and action sequence
• Configuration — every remediation key