Quarantine (Endpoint).

An endpoint security action that moves a suspected-malicious file out of its original location into a controlled, neutered store so it cannot execute but can still be analyzed or restored. It belongs to the Defense & Operations category of cybersecurity.

An endpoint security action that moves a suspected-malicious file out of its original location into a controlled, neutered store so it cannot execute but can still be analyzed or restored.

Quarantine is the historical response action that AV, NGAV, and EDR products take when a file is convicted as malicious. The agent removes the file from disk (or denies further access), encrypts it with a key only the agent knows, and stores it in a protected directory — for example, ProgramData\Microsoft\Windows Defender\Quarantine on Windows or /Library/Application Support/CrowdStrike on macOS — together with metadata about the detection. Defender, ESET, CrowdStrike, SentinelOne, and Sophos all expose centralised quarantine consoles where administrators can review, release after triage, or submit samples to the cloud lab. Quarantine differs from endpoint isolation: it neutralises a single file while isolation severs the whole host. Both are commonly orchestrated by SOAR playbooks during incident response.

Defences for Quarantine (Endpoint) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: File quarantine, Malware quarantine, Endpoint quarantine.