{"id":7953,"date":"2026-10-14T11:09:39","date_gmt":"2026-10-14T08:09:39","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=support_article&p=7953"},"modified":"2026-10-14T11:09:39","modified_gmt":"2026-10-14T08:09:39","slug":"how-to-configure-the-automatic-action-on-infection-when-elements-agent-detects-a-malicious-file","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/how-to-configure-the-automatic-action-on-infection-when-elements-agent-detects-a-malicious-file\/","title":{"rendered":"How to configure the automatic action on infection when Elements Agent detects a malicious file?"},"content":{"rendered":"

Issue:<\/h3>\n

How to configure the automatic action on infection when Elements Endpoint Protection Agent detects a malicious file?<\/p>\n

Resolution:<\/h3>\n

The action on infection for Elements Endpoint Protection is by default is set to 'Quarantine'. To modify this setting:<\/p>\n

    \n
  1. Log in to the Elements Security Center portal<\/li>\n
  2. Navigate to the Security Configurations > Profiles<\/strong> page<\/li>\n
  3. Click on the profile that is in use on the device<\/li>\n
  4. Go to the Real-time scanning <\/strong>settings page<\/li>\n
  5. Scroll down to the File scanning <\/strong>section<\/li>\n
  6. Select desired action from the Action on infection<\/strong> drop-down menu:\u00a0\n
      \n
    1. Device action on infection automatically<\/li>\n
    2. Rename<\/li>\n
    3. Delete<\/li>\n
    4. Disinfect<\/li>\n
    5. Quarantine<\/li>\n
    6. Ask after scan<\/li>\n
    7. Block<\/li>\n<\/ol>\n<\/li>\n
    8. Click Save profile<\/strong><\/li>\n<\/ol>\n

      Note that riskware and spyware have their own separate "action on riskware" and "Action on spyware" settings. If a detected file is not following the action set for infection, please check from the Events > Security Events <\/strong>page if the detected file is classified as either riskware or spyware.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

      In Elements Endpoint Protection profile, where do I place the desired actions in a manual scan and real time scan when it finds a malicious file?\u00a0<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-7953","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000005356","source_version":1,"source_system":"salesforce","source_date_updated":"2026-10-14 08:09:39","import_hash":"0e19df532f477c988cc37e1526112fd8086f710d","vanilla_article_id":"","vanilla_url":"","vanilla_kb_id":"","vanilla_category_id":"","machine_translated":false,"reactions_helpful_yes":"","reactions_helpful_no":""},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/7953","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=7953"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=7953"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}