We have it set in our policy to "Delete and Quarantine" threats. Where does it actually quarantine it incase we have to restore it?
You can check it in the policy settings for MOVE multiplatform under quarantine tab. You can create a client task to restore from quarantine.
Go to Client Task Catalog > From Client Task Types, select MOVE AV [Multi‑Platform] Client 3.6.1 > Restore From Quarantine