Support articles
Find clear, step-by-step solutions to common WithSecure issues across installation, configuration, updates, and product performance.
How to see additional details why Elements Endpoint Protection has quarantined or deleted a file?
Last updated
Issue:
How or where to see additional details why Elements Endpoint Protection has quarantined or deleted a file? Local Elements Agent user interface does not show enough information when clicking on the downwards arrow for show details.
Resolution:
You can see all the quarantine and detection details and more from the Elements Security Center portal's Events > Security Events page.
Follow these steps:
- Log in to the Elements Security Center portal: https://elements.withsecure.com
- Navigate to the Environment > Devices page
- Click on the device name for which you want to see the detection details
- Click Show security events from the top-left corner of the device details page
This will take you to the Events > Security Events page where it automatically uses the device's Unique ID (UUID) as the filter, so it only shows the alerts that have been sent from that device.
You can click on the downwards arrow on the left side of a detection to view all the details for a specific alert.
This page can show details such as:
- Alert type
- File size
- Reputation
- Infection name
- Prevalence
- Process that created the file
- Process used to access
- Path
- Application hash
- Hash of the accessing process