In the old days of endpoint security, when you were using signature-based AV, incident alerts were clear cut. If your AV quarantined a file, you could be sure it was malicious because your AV directly matched it to known malware. With modern endpoint protection like Barkly, it’s not always so black and white.
Article Link: https://blog.barkly.com/barkly-new-incident-response-features-quarantine-isolate-investigate