When a threat is detected by Inbound Shield, admins have an option of automatically sending notifications to the recipient of the email, the reviewer team, or both.
This can be selected from the “Secondary actions” menu under any section of the “Threat Prevention Rules” section.
By clicking on the “Notification Options” button, you can configure when recipients and reviewers should receive notifications of quarantined emails.
To configure, open the “Select notification timing” menu for reviewers/recipients and select one or more of the following options:
Notify Immediately:
When this option is selected, reviewers or recipients will receive a separate notification for each threat as it comes in. The notification sent to the reviewer will look similar to this:
This notification contains extensive information about the email that was quarantined, as well as a link to review the full email threat analysis and take actions such as releasing the email or blocklisting the sender.
Note: immediate notifications sent to recipients will appear similar, but in most cases recipients will not be able to review and take actions on their own quarantined emails.
Notify every set amount of hours:
You may also choose to receive aggregate reports of threats and quarantined emails every set amount of hours. The available options are:
- Every hour
- Every 3 hours
- Every 6 hours
- Every 8 hours
These aggregate reports will be sent in the format of a table, divided into threat categories such as “Malicious” and “Spam”. Each quarantined email will be displayed in a separate row and available actions will be on the right end of the row.
Custom notification times:
In addition to the options mentioned above, you may also choose the “Custom notification times” option which allows you to select the specific hours of the day at which quarantined email reports should be sent to recipients or reviewers.
Message for recipients:
The “Add message” field allows admins to add a custom message to recipient quarantine reports.
This message may contain, for example, further information about how to handle possible threats or who to contact to release quarantined emails.
The message can be added in plain text format or as HTML.
Release requests:
When recipients cannot release their own quarantined emails, e.g. when the email was detected as “Malicious”, admins can allow recipients to submit a request for the reviewer team to release this email.
This can be done by selecting the “Allow recipients to request release” check box.
In addition, you can customize some aspects of the release request email:
“Send the release request to:” (input, optional): Here you can specify which admin/reviewer should receive the automated requests to release quarantined emails. If this field is empty, these requests will automatically be sent to the primary reviewer.
“Release request email title” (input, optional): Allows you to customize the subject line of “Release request” emails. As listed in the example, you may also use dynamic fields to add information about the sender or the email. For example, {{RECIPIENT_EMAIL}} will add the email address of the recipient who received the quarantined email.