Apple Mac Endpoint - manage items in Quarantine

Question

I wanted to consult documentation before calling and support the user remotely. Unfortunately, all I could find were old forum posts and documentation for retired products. Is there something helpful I can read about it? As I'm not using a Mac I'm not familiar with the Sophos endpoint on it. 
 There was a false positive Cryptoguard detection that has been resolved, caused by a Google Chrome update.

Gladys · Answer

Hi LHerzog , 
 Thank you for reaching out to the Sophos Community Forum. If this has already been resolved and you're looking to reset the health status, you may reset the detection count on Mac endpoint . 
 If that doesn't work, you may perform the following steps: 
 1. Turn off the Tamper Protection. 2. Click on Go from the Finder menu and then select Computer. 3. Enter the startup volume which is usually Macintosh HD. 4. Go to Library > Sophos Anti-Virus. 5. Rename the file events.db to events_old.db 6. (only if malware events need to be cleared) Rename the file quarantine*.db to quarantine*.old 7. (only if malware events need to be cleared) Rename the file quarantine*.db-shm to quarantine*.shm.old 8. (only if malware events need to be cleared) Rename the file quarantine*.db-wal to quarantine*.wal.old 9. Enter the Mac admin password to authorize the change. 10. After a few seconds, new files should be created. 11. Verify that the Sophos Endpoint user interface status and events count are green and 0, respectively. 12. Turn on the Tamper Protection. 
 We recommend to only perform these steps if the Reset Summary option didn&rsquo;t work. Please let me know how it goes.