Before
Security analysts likely had to open the quarantine inventory on a recurring basis, inspect objects individually, and switch between several threat intelligence services to assess file hashes. They then had to consolidate the findings, notify the team, and coordinate purge or restoration decisions manually.
How it works
- On schedule, retrieve quarantined objects and post a scan-start notice in the designated Slack channel.
- Enrich eligible objects with multiple threat intelligence lookups, classify the findings, and publish a structured report in the message thread.
- Wait for a human selection to purge all or selected categories, then offer controlled restoration options for remaining files.
Workflow details
- Scheduled review: The workflow starts on a predefined schedule, announces the scan in a Slack channel, and retrieves the current set of quarantined objects.
- File triage: It identifies objects that have not been scanned or have an unspecified sandbox status, then checks their hashes against multiple threat intelligence sources to collect maliciousness scores, malware lookup results, sandbox status, and reputation information.
- Risk classification: The workflow separates findings into malicious hits, clean or negative results, and objects with positive quarantine indicators. It applies the configured reputation and analysis conditions before preparing the report.
- Actionable reporting: A structured scan summary is posted in the original Slack message thread, including object identifiers, analysis results, quarantine reasons, and dynamically selected controls for purging all files, ESET-positive files, third-party-checked files, or closing the review.
- Human-approved remediation: After a purge decision, the workflow reports completion and offers follow-up controls to restore all remaining files, restore only the negative results, or close the event. Purge and restore operations occur only after the corresponding user action is selected.
What changed
Quarantine review now begins automatically on a schedule and produces a contextualized Slack thread with the relevant analysis and counts. Threat intelligence checks, categorization, status updates, and action-button preparation happen before a human decision, while purge and restore actions remain explicitly user-approved.
Work removed
Manually reviewing the quarantine inventory, checking eligible file hashes across four threat intelligence sources, comparing scan and reputation results, compiling a team report, posting status updates, and executing repeated purge or restore requests one object at a time.
Expected outcome
Each scheduled run removes at least one manual quarantine review and can avoid up to four separate threat intelligence lookups per eligible object, while preserving human approval for remediation.
