Un-quarantining computers

From the Manage Vulnerable Computers dashboard you can view all of the computers that you manage in BigFix and view CVEs, associated risk, and quarantine data for each computer. You can also quarantine and un-quarantine Microsoft Windows computers.

Before you begin

You must have the policy action set up for un-quarantining, as described in the Requirements section.

About this task

You can view the computer ID, the computer name, QRadar Computer Risk Score, quarantine state, and CVEs associated with the computers that you manage. Using this enriched vulnerability information, you can quickly identify the computers that are at risk. You can also quarantine and un-quarantine computers.

You can un-quarantine only Microsoft Windows computers and you can un-quarantine only one computer at a time.

Complete the following steps to un-quarantine a Microsoft Windows computer.

Procedure

  1. From the Manage Vulnerable Computers dashboard, click the Computers tab.
  2. Select the computer that you want to un-quarantine.
  3. Click Un-quarantine Computer.
  4. From Execution tab on the Take Action dialog box, you can schedule a time for the computer to be un-quarantined, or click OK to un-quarantine the computer immediately.

Results

Only one action is generated for the un-quarantine Fixlet®. So for each subsequent computer that you un-quarantine, the existing un-quarantine action is updated to include the latest computer un-quarantined. To view an updated action, from the Endpoint Protection domain, select Actions and select the Un-quarantine action. Click Reported Computers and you can see the computers for which the un-quarantine action has run.