What is Quarantine?

Quarantine is a data loss prevention (DLP) and cloud access security broker (CASB) enforcement action that redirects a file matching a policy violation to a customer-controlled cloud storage location instead of letting it reach its destination or stay in place, isolating sensitive or malicious content while preserving it for review.

Key takeaways

• Quarantine moves a flagged file to isolated cloud storage, not deletion.
• DLP rule types like File Type, EDM, and OCR can trigger quarantine.
• A tombstone file replaces the original, explaining why it was quarantined.
• Quarantine profiles define the storage app, instance, and folder owner.
• SaaS and IaaS apps alike – Box, AWS, SharePoint – can host quarantine folders.

On this page: Why it matters · How it works · Types · Quarantine & Versa · FAQ

Why is quarantine important?

Data loss prevention and cloud access security broker policies stop sensitive or malicious content from reaching its destination, but an outright block or delete can be too blunt – it destroys evidence and gives no chance to review a false positive before the data is gone. Quarantine closes that gap: instead of deleting a file that matches a DLP rule, the file moves to a customer-controlled cloud storage location, isolated from its intended recipients but available for administrators to inspect, restore, or escalate.

That reversibility matters operationally. A legitimate file caught by an overly broad rule can be recovered rather than lost for good, and the quarantined copy preserves a forensic trail that a straight delete would erase. For organizations running SaaS and IaaS applications at scale, quarantine is what makes DLP enforcement safe to turn on without risking silent, irreversible data loss.

What is quarantine?

Quarantine is an enforcement action available to certain DLP rule types – File Type, Exact Data Match (EDM), and Optical Character Recognition (OCR) – and to Advanced Threat Protection (ATP), which can quarantine files it scores suspicious or malicious. Instead of being allowed, blocked, or rejected, a matching file is sent to a cloud service and relocated to a destination defined by a quarantine profile.

An administrator configures that profile with a storage application (Box, Dropbox, Google Drive, OneDrive, or SharePoint, among others), an instance of it, and the email address of the user under whose account the folder is created. The original file is typically replaced with a tombstone – a placeholder explaining why it was removed. Creating a profile requires an application connector to already exist for the chosen cloud application.

Types of quarantine destinations

Quarantine profiles fall into two broad destination categories, matching the application families API-based data protection covers. SaaS destinations – Box, Citrix ShareFile, Dropbox, Egnyte, Google Drive, OneDrive, and SharePoint – create a folder under a specified user’s account. IaaS destinations – AWS, Google Cloud Platform, Azure, and Oracle Cloud Infrastructure – use an object storage container or bucket, restricted to administrators only.

A second distinction is what triggers the move. DLP-triggered quarantine fires from File Type, EDM, or OCR rule matches; ATP-triggered quarantine fires when a malware verdict comes back suspicious or malicious. Both use the same profile mechanism, for different reasons.

Quarantine & Versa

In Versa Concerto, quarantine is configured under Configure > Security Service Edge > Profiles and Connectors > Quarantine Profile. A profile specifies a name, description, enabled/disabled toggle, destination application and instance, and tombstone text for both DLP and ATP cases – administrators can keep Versa’s default wording or write custom text. Creating a profile requires an application connector to already exist; each connector instance also declares which services it supports: API-based data protection, forensic, legal hold, and quarantine.

Quarantine profiles are then referenced from policy rules: a DLP rule can name quarantine as its action for a File Type, EDM, or OCR match, and an ATP rule can do the same for suspicious files. Support arrived in release 12.2.1. See Configure Quarantine Profiles in Concerto and Configure Cloud Applications to Use with API-Based Data Protection for the full procedures.

Frequently asked questions

What triggers a quarantine action?

DLP rule types such as File Type, Exact Data Match, and Optical Character Recognition can name quarantine as their match action, and Advanced Threat Protection can quarantine any file it scores suspicious or malicious during scanning, in place of an outright block or reject.

Where do quarantined files go?

To a folder or object-storage location in a customer-provided cloud application – Box, Dropbox, Google Drive, OneDrive, SharePoint, or an IaaS bucket in AWS, Azure, GCP, or OCI – set by the destination application and instance configured in the quarantine profile.

What is a tombstone file?

A tombstone is the file that replaces a quarantined file at its original location, explaining that it was removed and why. Administrators can keep Versa’s default tombstone text or write custom wording, configured separately for both DLP and ATP quarantine cases.

Is quarantine the same as deletion?

No. Quarantine moves a matching file to an isolated, access-restricted cloud location instead of deleting it outright – preserving the content for administrator review, forensic investigation, or legal hold rather than destroying the underlying evidence permanently and without any recourse.

Who can access a quarantine folder?

Access should always be limited to administrators only. For SaaS destinations, the folder is created under a specified user’s account; for IaaS destinations, the storage container or bucket should be restricted strictly to administrator access, per Versa’s official quarantine guidance.

More on quarantine

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about quarantine, these are worth looking at next.