Based on whether you are using the Master Attack Repository page or the policy editors, you have completed the steps provided in the previous sections.
On the Attack Definitions tab, double-click on the row of the attack that you want to configure and update the settings. The attack details are displayed on the right panel displaying the settings under the Settings tab.
Configure the settings for the attack definitions in the Quarantine field, under Sensor Actions.
The following are the available Quarantine options:
Inherit (Disabled)
Quarantine Attacker
Quarantine and Remediate
Attacker
Disabled
Click Update and then Save in the Attack Definitions window.
If the modified policy is applied to a Sensor, you need to update the Sensor configuration, for the changes to be effective.