> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/file-commands.md).

# File Commands

* [quarantineFile](#quarantinefile)
* [getFileQuarantineStatus](#getfilequarantinestatus)
* [reportIncorrectWildfire](#reportincorrectwildfire)
* [restoreFile](#restorefile)

#### quarantineFile

***

Quarantines a file on selected endpoints, moving it to an isolated location so it can no longer run. You can select up to 1000 endpoints. Use restoreFile to reverse this action.

Note: This is a polling command. / This command has a quick action: Quarantine File.

<details>

<summary>Arguments</summary>

| Argument Name         | Description                                                          | Required |
| --------------------- | -------------------------------------------------------------------- | -------- |
| endpoint\_ids         | A comma-separated list of endpoint IDs.                              | Required |
| file\_path            | String that represents the path of the file to quarantine.           | Required |
| file\_hash            | String that represents the file's hash. Must be a valid SHA256 hash. | Required |
| case\_id              | Links the response action to the case that triggered it.             | Optional |
| interval\_in\_seconds | Interval in seconds between each poll.                               | Optional |
| timeout\_in\_seconds  | Polling timeout in seconds.                                          | Optional |

</details>

<details>

<summary>Outputs</summary>

**Core.quarantineFiles.actionIds.endpointIdList** *string*

The list of endpoint IDs where the file was quarantined.

**Core.quarantineFiles.actionIds.filePath** *string*

The path of the quarantined file.

**Core.quarantineFiles.actionIds.fileHash** *string*

The hash of the quarantined file.

**Core.quarantineFiles.actionIds.actionId** *number*

The action ID of the quarantine request.

</details>

#### getFileQuarantineStatus

***

Retrieves the quarantine status for a specific file on an endpoint.

<details>

<summary>Arguments</summary>

| Argument Name | Description                                 | Required |
| ------------- | ------------------------------------------- | -------- |
| endpoint\_id  | The endpoint ID.                            | Required |
| file\_hash    | The file hash. Must be a valid SHA256 hash. | Required |
| file\_path    | The file path.                              | Required |

</details>

<details>

<summary>Outputs</summary>

**Core.QuarantineFiles.status.status** *unknown*

The quarantine status of the file.

**Core.QuarantineFiles.status.endpointId** *string*

The endpoint ID where the file is quarantined.

**Core.QuarantineFiles.status.filePath** *string*

The path of the quarantined file.

**Core.QuarantineFiles.status.fileHash** *string*

The hash of the quarantined file.

</details>

#### reportIncorrectWildfire

***

Reports an incorrect WildFire verdict for a file hash.

<details>

<summary>Arguments</summary>

| Argument Name | Description                                                               | Required |
| ------------- | ------------------------------------------------------------------------- | -------- |
| file\_hash    | The SHA256 hash of the file to report.                                    | Required |
| new\_verdict  | The corrected verdict for the file. Possible values are: benign, malware. | Required |
| reason        | The reason for reporting the incorrect verdict.                           | Required |
| email         | The reporter's email address.                                             | Required |

</details>

<details>

<summary>Outputs</summary>

**Core.WildFire.file\_hash** *string*

String that represents the file's hash.

**Core.WildFire.new\_verdict** *string*

The new verdict of the file.

</details>

#### restoreFile

***

Restores a previously quarantined file on the requested endpoints, returning it to its original location. If no endpoint\_id is provided, the file is restored on all endpoints where it was quarantined.

Note: This is a polling command. / This command has a quick action: Restore File From Quarantine.

<details>

<summary>Arguments</summary>

| Argument Name         | Description                                                                                                                                  | Required |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| file\_hash            | String that represents the file in hash. Must be a valid SHA256 hash.                                                                        | Required |
| endpoint\_id          | String that represents the endpoint ID. If not provided, the request will run restore on all endpoints which relate to the quarantined file. | Optional |
| case\_id              | Links the response action to the case that triggered it.                                                                                     | Optional |
| interval\_in\_seconds | Interval in seconds between each poll.                                                                                                       | Optional |
| timeout\_in\_seconds  | Polling timeout in seconds.                                                                                                                  | Optional |

</details>

<details>

<summary>Outputs</summary>

**Core.restoredFiles.actionId** *number*

The action ID of the restore request.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/file-commands.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.