The “Quarantined Emails” page displays all the emails which are currently being quarantined for your protected mailboxes. From this page, admins and reviewers can view all quarantined emails and perform actions on them.
You can access this page from the Trustifi web portal either by clicking on “Inbound Management” and then on the “Quarantined Emails” page, or by typing in “Quarantine” in the global search bar.
Quarantined emails that have been released (either manually or by one of your rules and policies) will still show a record on this page, as well as any other type of email for which the “Keep Record” setting has been enabled. To configure which email record should be kept on this page, please consult our Threat Prevention Rules guide.
Only users with admin permissions or users who have been set as “reviewers” can view the quarantined emails list for the entire organization. Regular users can have access to their own quarantined emails list, however they cannot release their own quarantined emails and cannot view quarantined emails for other mailboxes.
Showing Quarantined Emails
To show quarantined emails, you will need to create and run a query. This can easily be done by clicking on the “Query builder” icon (to the left of the “Get Emails” button), selecting your query parameters (time period, category, status, etc.), and clicking on “Get Emails” to display the results.
Date/time period selector
The default time period to display quarantined emails is from the last day, but using the date selector you can also choose to show emails from the last 3 days, last week, last month, or in a custom date range of your choosing.
Message ID
Instead of querying emails by date/category/sender/etc. , you can search for specific emails based on their message ID by selecting this option in the query builder:
Page Layout
Quarantined emails will be displayed in a table formation, with multiple columns that provide information about the email:
- Received: shows when the quarantined email record was created in the system. This timestamp almost always corresponds with the time the email was received by the recipient(s).
- Mailbox: shows which mailbox was the recipient of the email. If the email was received by more than one person, it will show how many mailboxes received the email and you can click to display a list of the individual mailboxes that received the email.
- Sender: the person/mailbox who sent the email. You can hover over the sender email to show more details such as the email’s message-ID.
- Subject: the subject of the received email.
- Status: the status of the email indicates if it is still quarantined, or if it has been released by a rule/by a reviewer. The status will also show if a released email has been removed from the mailbox, and additional information such as if the sender has been whitelisted or blacklisted either globally or for the user specifically.
- Category: specifies if the email is safe, or if it has been categorized as malicious, suspicious, spam, or as graymail. If you choose to keep records for external emails, then safe external emails will be displayed under the “External” category.
- Tags: shows more advanced information about the detections made in this email, in the form of tags. Each tag represents a type of threat that was found in the email (e.g. “Contact impersonation” / “Phishing metrics”, “Email blacklist”, etc.) and a single email can have multiple tags to represent multiple threats. You can click on a tag to display all the emails (within your query parameters) that have the same tag.
The table can be sorted to your convenience according to any one of these columns either in descending or ascending order. To sort by a column simply click on the up/down arrow icon next to the column title.
Search, filters, and more actions
At the top-right corner of the quarantined emails table you will find more tools that can help you narrow down your search results and perform other actions.
Search: Allow searching the queried results by recipient/sender/subject/tags, or message-ID
Filter: Filters the queried results by different parameters such as the email category, status, and more.
Export to CSV: Creates and downloads a CSV with the information displayed on the page.
Generate report (under “More actions”): Generate a report based on customizable information about your quarantined emails. Also allows receiving scheduled reports of quarantined emails on a daily/weekly/monthly basis.
