Coro works in tandem with Microsoft 365 malware detection.
Coro detects malware in files as soon as they are uploaded from an external source or the user's device to cloud storage.
Microsoft 365 malware detection typically occurs 15 minutes or more after a file download. If a scan identifies a file as malicious, Microsoft 365 restricts its sharing capabilities, and OneDrive displays a warning, indicating the file cannot be shared. Additionally, Microsoft 365 does not detect certain file types.
Coro detects malware in files immediately upon upload from an external source or the user's device to cloud storage.
When Coro first detects malware, it creates a quarantine folder (named "Suspected folder"), moves suspected malware files to the folder, and creates a ticket for the event. The quarantine folder is visible within the cloud storage service and Coro recommends that administrators restrict access in line with your organization's security policies. The admin user has the following remediation actions available:
Approve file: Restore the file to its original location on the cloud drive. The admin user can choose to close the current ticket along with all related tickets immediately.
Delete file: Permanently delete the quarantined file from the "Suspected folder".
In some cases, Microsoft 365 identifies malware before Coro detects it. When this occurs, Microsoft 365 prevents the file from being sent to Coro’s quarantine folder. Although Coro still logs the event and creates a ticket, Coro cannot take any remediation actions on the file because Microsoft 365 has already addressed the threat.
When this happens, an admin user can still review tickets raised by Coro to notify about the malware identification and can still perform actions such as suspend the user or close the ticket. However, as Microsoft 365 has already dealt with the threat, the Approve file and Delete file actions are not available.