Support articles
Find clear, step-by-step solutions to common WithSecure issues across installation, configuration, updates, and product performance.
How to configure the automatic action on infection when Elements Agent detects a malicious file?
Last updated
Issue:
How to configure the automatic action on infection when Elements Endpoint Protection Agent detects a malicious file?
Resolution:
The action on infection for Elements Endpoint Protection is by default is set to 'Quarantine'. To modify this setting:
- Log in to the Elements Security Center portal
- Navigate to the Security Configurations > Profiles page
- Click on the profile that is in use on the device
- Go to the Real-time scanning settings page
- Scroll down to the File scanning section
- Select desired action from the Action on infection drop-down menu:
- Device action on infection automatically
- Rename
- Delete
- Disinfect
- Quarantine
- Ask after scan
- Block
- Click Save profile
Note that riskware and spyware have their own separate "action on riskware" and "Action on spyware" settings. If a detected file is not following the action set for infection, please check from the Events > Security Events page if the detected file is classified as either riskware or spyware.