Global Quarantine

Emails that trigger a Message Rule with a Final Action of Quarantine - Company will be placed in the Global Quarantine.

Quarantined emails are available for 30 days

Email Security users also have access to a Personal Quarantine.

In the Email Activity report, a message that shows a Sending IP as 0.0.0.0 means that the email was released from the Quarantine. Please view the Admin Audit for further details of who released it and when.

Reviewing quarantined messages

To see recently quarantined messages, visit your USS Dashboard and click ProductsE-mail SecurityGlobal Quarantine.

  1. Choose a timespan to view from the drop-down list. You can choose to view data for the last hour, day, week or month; or you can specify your own time range by choosing Specific and using the data picker.
  1. Choose whether you want to view emails that have been quarantined as Spam or emails that have been quarantined as possibly containing a Virus.
  2. Optionally, you can click to narrow down the results by a specific Sender, Recipient, Subject or email Direction.
  1. Click Run Report

For each result, you'll be able to see

  • The local timestamp for the email (when it was sent or received by the server).
  • The sender address.
  • The sender IP address.
  • The subject of the email.
  • The recipient(s) of the email.
  • The rule that triggered the message to be quarantined.
  • The size of the email and attachments.
In addition, messages that trigger high spam scores will be colour coded in severity from yellow (medium) to red (severe) as an indication that special care should be taken when managing the item.

Managing the Quarantine for Child Accounts

If your account has provisioning rights and you manage child accounts with Email Security, it is possible to manage the Quarantine area (subject to the child account granting remote management rights) but you must use an administrator that is not associated with an existing mailbox. Logging in as a user with administrator privileges that is also a valid mailbox will lock the Quarantine view to the users own account and quarantine, therefore viewing a child account quarantine will show zero results.

By default, the master @clouduss.com administrator is able to manage all child account quarantines. This account should always use strong credentials and have SMS or TOTP authentication enabled.

Viewing quarantined messages in more detail

To see more detail about a quarantined message, click the Magnifying Glass icon next to the message or double click the message in the list. The Message Detail window will be displayed.

General

Use the General tab to see a summary of the email. You can click the GUID to open an Email Activity Report that contains the email.

Actions

The Actions tab will list all the actions that have been taken against this email. This includes Rules that the email has triggered but which have not resulted in a Final Action.

Attachments

The Attachments tab lets you view the attached filenames, file types and size. Users with the administrator role are also able to download file attachments.

Headers

Use the Headers tab to see a detailed breakdown of all the message headers in this particular email.

Export headers

You can use the button to export the email headers, either to .csv format or to an Excel spreadsheet.

Server Log

You can see the full server log for this email. This will show every interaction the server has performed for this email.

Export server log

You can use the button to export the server log for this email, either to .csv format or to an Excel spreadsheet.

Previewing quarantined messages

You can safely preview a quarantined message by clicking the email's subject in the Global Quarantine screen. This will request a secure screenshot of the email message, stripped of any script code and links.

The maximum preview that will be returned is 800x2500 pixels.

Categorising quarantined messages

You can choose to either Deny or Release a quarantined email. By doing so, you will teach Email Security what action to take against similar emails in the future.

Click to select an email from the list, and choose to either Delete, Deny or Release.

Delete

To delete the email, click the icon. Deleting a message will remove it from the Global Quarantine list, and permanently delete it from the server, but will have no effect on future emails.

Deny

To deny an email, select the email and choose an option from the drop-down list.

Deny Sender

The email will not be delivered, and any further emails sent to your server from the same sender will automatically be denied. You should delete the email from the quarantine if it is no longer required.

Deny Domain

The email will not be delivered, and any further emails sent to your server any address at the originating domain will automatically be denied. You should delete the email from the quarantine if it is no longer required.

Release

To release an email from quarantine, select the email and choose an option from the drop-down list.

Release

Releases the email from quarantine, but has no effect on further emails from the same sender.

Safe sender

Releases the email from quarantine, and adds the sender's email address to your Global Safe List.

Safe domain

Releases the email from quarantine, and adds the sender's domain name to your Global Safe List.

Send Copy

To send a copy of a quarantined email to another recipient, select the email and click the Send Copy button.

Enter the recipient email address into the prompt to send a copy of the email message.

Sending a copy of the quarantined message may expose the recipient to any scam or malicious content contained in the message. Please also ensure you are not disclosing confidential information to the recipient.

Reprocess Messages

As an administrator, you may want to make changes to email Message Rules, for example to be able to correct a false positive or allow email from a specific sender. You can request that quarantined messages are reprocessed again to attempt re-delivery by selecting the messages and clicking Reprocess Messages.

Messages will be temporarily removed from the quarantine whilst delivery is attempted again. The message may reappear again if delivery is still not possible due to one or more message rules. Review the Actions tab to troubleshoot further.


How did we do?