Indicator set to block, but I'm still prompted for approval

%3CLINGO-SUB%20id%3D%22lingo-sub-1673504%22%20slang%3D%22en-US%22%3EIndicator%20set%20to%20block%2C%20but%20I'm%20still%20prompted%20for%20approval%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1673504%22%20slang%3D%22en-US%22%3E%3CP%3EYesterday%20I%20added%20a%20malicious%20file%20indicator%20and%20set%20it%20to%20Alert%20and%20Block%20(side%20note%3A%20Block%20only%20would%20be%20great%20to%20have).%26nbsp%3B%20This%20morning%20another%20user%20in%20my%20environment%20came%20across%20the%20file%2C%20but%20it%20did%20NOT%20quarantine%20the%20file--%20I%20had%20to%20approve%20it.%26nbsp%3B%20How%20can%20I%20have%20an%20indicator%20automatically%20quarantined%3F%26nbsp%3B%20I%20created%20the%20indicator%20because%20I%20know%20it's%20evil.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20thinking%2Fhoping%20that%20this%20isn't%20related%20to%20the%20remediation%20level%20setting%20-%20because%20the%20choices%20there%20are%20more%20broad%20and%20don't%20speak%20to%20indicators.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20so%20much%20for%20help%20in%20advance!%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Yesterday I added a malicious file indicator and set it to Alert and Block (side note: Block only would be great to have).  This morning another user in my environment came across the file, but it did NOT quarantine the file-- I had to approve it.  How can I have an indicator automatically quarantined?  I created the indicator because I know it's evil. 

 

I'm thinking/hoping that this isn't related to the remediation level setting - because the choices there are more broad and don't speak to indicators.

 

Thank you so much for help in advance!

0 Replies