File Commands

• quarantineFile
• getFileQuarantineStatus
• reportIncorrectWildfire
• restoreFile

quarantineFile

---

Quarantines a file on selected endpoints, moving it to an isolated location so it can no longer run. You can select up to 1000 endpoints. Use restoreFile to reverse this action.

Note: This is a polling command. / This command has a quick action: Quarantine File.

Arguments

Argument Name	Description	Required
endpoint_ids	A comma-separated list of endpoint IDs.	Required
file_path	String that represents the path of the file to quarantine.	Required
file_hash	String that represents the file's hash. Must be a valid SHA256 hash.	Required
case_id	Links the response action to the case that triggered it.	Optional
interval_in_seconds	Interval in seconds between each poll.	Optional
timeout_in_seconds	Polling timeout in seconds.	Optional

Outputs

Core.quarantineFiles.actionIds.endpointIdList string

The list of endpoint IDs where the file was quarantined.

Core.quarantineFiles.actionIds.filePath string

The path of the quarantined file.

Core.quarantineFiles.actionIds.fileHash string

The hash of the quarantined file.

Core.quarantineFiles.actionIds.actionId number

The action ID of the quarantine request.

getFileQuarantineStatus

---

Retrieves the quarantine status for a specific file on an endpoint.

Arguments

Argument Name	Description	Required
endpoint_id	The endpoint ID.	Required
file_hash	The file hash. Must be a valid SHA256 hash.	Required
file_path	The file path.	Required

Outputs

Core.QuarantineFiles.status.status unknown

The quarantine status of the file.

Core.QuarantineFiles.status.endpointId string

The endpoint ID where the file is quarantined.

Core.QuarantineFiles.status.filePath string

The path of the quarantined file.

Core.QuarantineFiles.status.fileHash string

The hash of the quarantined file.

reportIncorrectWildfire

---

Reports an incorrect WildFire verdict for a file hash.

Arguments

Argument Name	Description	Required
file_hash	The SHA256 hash of the file to report.	Required
new_verdict	The corrected verdict for the file. Possible values are: benign, malware.	Required
reason	The reason for reporting the incorrect verdict.	Required
email	The reporter's email address.	Required

Outputs

Core.WildFire.file_hash string

String that represents the file's hash.

Core.WildFire.new_verdict string

The new verdict of the file.

restoreFile

---

Restores a previously quarantined file on the requested endpoints, returning it to its original location. If no endpoint_id is provided, the file is restored on all endpoints where it was quarantined.

Note: This is a polling command. / This command has a quick action: Restore File From Quarantine.

Arguments

Argument Name	Description	Required
file_hash	String that represents the file in hash. Must be a valid SHA256 hash.	Required
endpoint_id	String that represents the endpoint ID. If not provided, the request will run restore on all endpoints which relate to the quarantined file.	Optional
case_id	Links the response action to the case that triggered it.	Optional
interval_in_seconds	Interval in seconds between each poll.	Optional
timeout_in_seconds	Polling timeout in seconds.	Optional

Outputs

Core.restoredFiles.actionId number

The action ID of the restore request.