The Quarantine page on the Analysis tab gives two options for Quarantine:
Extend
Release
To select the above options for a quarantined endpoint, do the following:
On the Analysis tab, select the Domain and then the Quarantine page.
Click Add to add an IP address to quarantine.
Quarantine settings.png "GUID-A9A45999-4AB9-4896-960F-6BB148ABD421-low.png")
The options are displayed for Quarantine:
Add — Add the endpoint from which the alert originated
Extend — Extends the quarantine duration for an endpoint.
Release — Removes the endpoint from Quarantine. When you select this option, a message is displayed to confirm if you want to release the endpoint from Quarantine. Select the required option.