Quarantining stuff with real-time AV disabled?

Is anyone else getting this? I wanted to test behavior and sandboxing part so i’ve disabled real-time AV component but during testing, CIS6 kept on quarantining files with signature detection. Why!? It doesn’t make sense if i have disabled the real-time AV. This shouldn’t happen. Or should it?

You can disable the file rating first.

In V5, it is called the cloud lookup.

Yep, this is probably a file rating cloud lookup, not a local AV file scan?

The thing is, popup itself didn’t say what detected it and thats very confusing. detection name itself didn’t mention any “cloud” word either.

@0 --------------> cloud scan

@XXXXXXXXX --------------> local AV

Please log as usability issue in sticky

Many thanks