Content Analysis (CA) provides two mechanism for alerting on events detected by a sandbox

Sandboxing Threat Admin Alert (Asynchronous) refers to newly discovered threats identified by the sandbox which got through to the endpoint.
 
Sandboxing Threat Alert refers to events that the sandbox blocked either using real time sandboxing (RTS) or blocking a file (that was found previously from sandbox ) via the hash cache.