What is quarantine? Quarantine is a secure, non-executable folder where Monarx isolates malicious files instead of deleting them, so they can no longer run but are still available for later inspection. When Active Protection is enabled on an account, the Monarx agent automatically moves any file it classifies as MALICIOUS into this quarantine folder in real time. Compromised (injected) files work differently — the malicious code is stripped out in place — so those aren't moved to quarantine.
Where it's stored?
The quarantine folder is per-user, and its location depends on the user_base (or base) setting in /etc/monarx-agent.conf. For each user under that base, Monarx creates a .quarantine folder directly inside their own directory:
/folder/username/.quarantine
E.g. /home/bob/.quarantine on the default cPanel base (/home/), or /var/www/bob/.quarantine on the default Plesk base (/var/www/). A custom user_base/base overrides the default.
Excluding it from scans: via exclude_dirs in monarx-agent.conf (e.g. exclude_dirs = /(\.quarantine|backup)/), review our Advanced Agent Configuration article for full syntax.