Quarantine

Overview

Quarantine is the safe storage for emails which were blocked or sanitized by MetaDefender Email Gateway Security.

For details about quarantine configuration, which emails are quarantined see Configuration/Quarantine configuration.

Search, Filtering and Email details

For details see Operating/Email History.

Saving filters

Under Quarantine > Quarantine in the filter section You have the possibility to save the already created filters to make it easier to manage your quarantine. Once the filter is set according to your needs you need to click on the Add button under next to the input. When you click on the freshly created filter, that will have an immediate effect on the email list, left side. Emails only according to the filter settings will be displayed.

Cleanup

Scheduled

For details see Configuration/Quarantine configuration.

On-demand

To clean-up quarantine on demand click the icon and select the time window of the cleanup.

Pin emails

Email that are pinned won’t be removed from the quarantine by the scheduled or the on-demand cleanup.

Clicking the button will pin the selected email(s).

Operations

The following operations are available as both bulk and single email operations:

Bulk operations

Use the checkbox in front of each row to select entries (or use the checkbox in the header row to select all visible items).

Single email operations

Click the in Email details to open the single email menu.

Adding to Trusted Senders

It is now possible to add sender (email or IP address) to the trusted senders list directly from the Quarantine view. Click the in Email information to open the single email menu.

Full rescan email

MetaDefender Email Gateway Security provides the capability to rescan emails that were previously blocked and ended up in the quarantine. After a rescan the email may be allowed and delivered normally. Some of the reasons why emails may be rescanned:

• To process the email with updated scan engines that may not block the contents,

• To process the email with an alternative rule that may give different results,

  • To sanitize a blocked email before releasing (see the section Disarm, reconstruct and release)

• To provide password for encrypted attachments and process the decrypted contents.

Select alternative rule

Provide password

For details see Operating/Password protected attachments.

Anti-malware rescan email

It is also possible to rescan an email using only the anti-malware technologies available in MetaDefender Email Gateway Security, omitting anti-spam & anti-phishing checks. This simplifies tasks, such as releasing a spam false positive while still ensuring that the email is free from malware. For details see Handling spam false positives.

Release email

This function will release the selected original emails from the quarantine and send them to the original recipients. The original emails are removed from the quarantine.

Disarm, reconstruct and release

It is a potential use case to sanitize emails before releasing them. This feature is not supported by the regular Release email function but can be achieved using Rescan email.

Preparations

1. On MetaDefender Core servers create a rule that does not scan, but applies the desired sanitization.
   1. It is necessary to allow the not scanned results for the Core rule (in Core under Policy > Workflow rules / Add/Modify Rule / ADVANCED / OVERRIDE SCAN RESULTS CLASSIFIED AS ALLOWED / NOT SCANNED). To allow password protected archives to be processed, the encrypted archive results must be disabled (in Core under Policy > Workflow rules / Add/Modify Rule / ADVANCED / OVERRIDE SCAN RESULTS CLASSIFIED AS ALLOWED / ENCRYPTED ARCHIVE)

2. On Email Gateway Security create a MetaDefender Core type server profile having the Core servers and rules created in the previous step. For details see Configuration/Server profiles.
3. On Email Gateway Security, under Security Rules create a rule using the server profile created in the previous step.
   1. Optionally set 0.0.0.0 as SENDER IP ADDRESS for this rule to not match any regular incoming emails or
   2. Set the priority of this rule accordingly if it is expected to process regular incoming emails.

Release

1. Instead of using the Release function use the Rescan function.
2. In the confirmation dialog select the rule created in the previous section:

3. The email will be re-processed using the newly selected rule.
   1. If the new rule allows the email, then it gets delivered normally.