Managing quarantined files is an endpoint-administration function. The Falcon Endpoint Manager role provides the permissions for endpoint management actions, including quarantine-file management; the Analyst – Read Only role cannot make changes, and the detections-exceptions role is limited to exception administration.
Community Discussion