Skip to content
Please update to the latest release 0.77.2 to address Multiple CVEs.
Custom quarantine exclusions

Custom quarantine exclusions

We may want to add custom exclusions to Velociraptor quarantine and allow communication to another IP

  1. Add machine in scope to a new label: e.g NewQuarantine
  2. Remove standard quarantine
  3. Run a hunt targeting your label above or a collection on the single machine
  4. Select relevant quarantine content: Windows.Remediation.Quarantine
  5. Add additional IP exclusions Action = Permit SrcAddr = me DstAddr = IP to exclude Mirrored = yes for bidirectional communication Description
image