File security and quarantine

AurionAI can scan files for malware before people can open them. On the File Security (Malware) page you switch scanning on or off and set how long quarantined files are kept. On the Quarantine page you review detections and release or delete quarantined files.

Availability: all profiles. Administrators only.

Prerequisites

• You have the Owner or Admin role. Other users see Access Denied.
• Scanning also needs the scanning service of your AurionAI deployment. If it is not enabled, the page shows this note: Scanning infrastructure is not enabled on this deployment - this setting has no effect until an operator enables it.

What AurionAI scans

When scanning is on, AurionAI scans files that arrive from these places, among others: conversation attachments, email attachments, knowledge base media and articles, Help Center forms and branding, profile pictures and phone regulatory documents. The Source column on the Quarantine page names the place for each detection.

What happens to an infected file depends on how it arrived:

• A file that someone uploads in the dashboard, the widget or a form is refused. AurionAI does not store it. The person sees an error, and the detection appears in the list without a stored file.
• An attachment on an incoming email is stored but held in quarantine. Nobody can open it until an administrator releases it.

What happens to an email attachment that AurionAI cannot scan:

• The scanner was unavailable, or the file is too large for the scanner. AurionAI holds the file in quarantine. The Threat column shows a technical code instead of a threat name, for example scanner_unavailable or file_too_large_to_scan.
• If the scanner was unavailable, AurionAI scans the file again automatically when the scanner is back, and releases it if it is clean.
• If the file is too large, AurionAI never scans it. It stays in quarantine until an administrator releases or deletes it.

Each time AurionAI finds malware, it sends the Malware detected in attachment notification to every owner and administrator of your organization, if Notify on quarantine is on.

Set the file security rules

1. In the sidebar, select Configuration.
2. Open the System category.
3. Select File Security (Malware).
4. Turn Enable malware scanning on or off.
5. In Quarantine retention (days), type a whole number from 1 to 365.
6. Turn Notify on quarantine on or off.
7. Select Save.

When scanning is off, you cannot change the retention field or the notification switch. A new organization starts with scanning on, 30 days of retention and notifications on, unless its template sets other values.

Review quarantined files

1. In the System category, select Quarantine.
2. Choose a view with the status buttons:
   • Quarantined (the default view): detections that still wait for a decision.
   • Unscannable: files that AurionAI accepted without being able to look inside. Most are encrypted files, such as protected archives. A file can also be here when the scanner was not available and AurionAI operators chose to accept uploads without a scan. These files are not held. You can remove a row from this view with Delete now. This only changes the detection, not the file. Read Delete a file or a detection.
   • Scan failed: files where the scanner failed. This view is for reading only.
   • Released and Deleted: decisions already taken, with Disposition by and Disposition at.
   • All history: every detection.
3. For each row, read Filename, Threat, Source and Detected.
4. To open the conversation of a file, select View in context.

Release a file

Release a file only when you are sure that the detection is a false positive. A file held because it could not be scanned was never checked. Release it only when you trust the sender.

1. In the Quarantined view, find the file.
2. Select Release.
3. Read the warning in the Release quarantined file? window and confirm.

AurionAI shows Quarantined file released. The file becomes available again where it arrived, for example in the conversation. AurionAI does not scan it again and sends no notification. The release is written to the audit log with your name.

You can release only stored files from conversations, email attachments and knowledge base media. A detection without a stored file has no Release button that you can use.

Delete a file or a detection

1. Find the row and select Delete now.
2. Read the window and confirm:
   • Delete quarantined file?: This permanently deletes the stored file. The detection log is retained for audit history.
   • Delete this detection?: AurionAI moves the detection to the Deleted view. If a file exists, AurionAI does not change it.

The deletion is written to the audit log.

Result

• Changes on the File Security (Malware) page apply to the next file that arrives. AurionAI shows Security settings saved.
• A cleanup job runs once a day. It deletes quarantined files that are older than the retention period. Files held because they are too large for the scanner are not deleted automatically. Release or delete them yourself.
• Every change on the File Security (Malware) page is written to the audit log.

If something goes wrong

• Enter a whole number of days between 1 and 365. The retention value is empty, 0, a decimal or above 365. Type a whole number from 1 to 365.
• Scanning is on, but no file is ever scanned. Look for the note about the scanning service at the top of the page. Contact AurionAI support. Read Get help.
• Failed to release quarantined file The file changed while you worked, or AurionAI refuses to release this file. Select Refresh. If the file still cannot be released, delete it.
• No notification arrives. Check that Notify on quarantine is on. Then check your notification preferences. Read Notification preferences.
• Couldn't load quarantined files. Please try again. Select Retry.

Related articles

• Audit log
• Notification preferences
• Roles and what they can do