The Quarantine page provides information of blocked and modified content, including some basic metadata. Each entry is linked to an Event (See Events).

Search and Filtering Options

• Search Bar: Allows users to search for specific quarantine based on keywords.

• Time Range: Narrows down entries by time range.

• Filters: Use the panel to narrow the list of entries using one or more search criteria. It includes:

  • Status: Filters entries by their current processing status (for example, Quarantined).

  • Verdict: Filters events by the final processing verdict.

  • Message ID: Searches for specific content using its unique Message ID.

  • Quarantine ID: Filters entries by its unique Quarantine ID.

  • Subject: Filters entries by the subject.

  • SMTP Sender: Filters entries by the SMTP envelope sender address.

  • From Address: Filters entries by the email sender shown in the From header.

  • Recipient: Filters entries by the recipient email address.

  • Policy Name: Filters entries processed by a specific policy.

  • Attachment Name: Filters entries containing attachments with a specified file name.

• Column visibility: Configure columns to display in list. Available are:

  • Select (Fixed Column): Allows for batch operations.

  • Quarantine ID (Fixed Column): Unique ID automatically assigned to each entry.

  • Actions (Fixed Column): Provides quarantine actions, like Release or Delete.

  • Policy: Shows the policy that was applied during processing.

  • Verdict: Displays the final security verdict assigned to the event.

  • Status: Shows the current processing status of the event (for example, Delivered or Quarantined).

  • Time of Event: Displays the date and time the event occurred. This column is fixed and cannot be hidden.

Quarantine List (Blocked & Sanitized Originals)

Each row in the list represents an event with the following details:

• Time of Event: Timestamp indicating when the event occurred.

• Quarantine ID: Unique identifier assigned to each security event.

• Status: The current status of the event, for example, Quarantined.

• Policy: Indicates the Policy that applied for the the content.

• Verdict: See Verdicts.

Viewing Details

Clicking the arrow next to a Quarantine ID expands detailed metadata about the quarantined content, including:

• Item type: Type of content.

• Affected User: The user(s) affected by the event.

• Sent at: Timestamp of when the content was sent.

• Received at: (Email only) Timestamp of when the content was received.

• Message ID: Unique message identifier.

• Subject: The subject of the content (for example, email subject).

• Sender & Recipients: Sender and recipients email address.

• From, To & Cc: (Email only) Identify the sender and recipients listed in the email header.

• Received from: (Email only) Endpoint from where content was received.

• Size: (Email only) Content size.

Actions

To the right of each quarantined item are action icons:

• View Event: Opens the associated event for detailed threat analysis. See Viewing Event details.

• Delete: Permanently removes the item from the system

• Release: Delivers the item to the intended recipient if deemed safe

• Download: (email only) Download the email.

These actions can help administrators quickly manage threat resolution or allow legitimate content that were flagged in error.