Yesterday I added a malicious file indicator and set it to Alert and Block (side note: Block only would be great to have). This morning another user in my environment came across the file, but it did NOT quarantine the file-- I had to approve it. How can I have an indicator automatically quarantined? I created the indicator because I know it's evil.
I'm thinking/hoping that this isn't related to the remediation level setting - because the choices there are more broad and don't speak to indicators.
Thank you so much for help in advance!
