Releasing Malware quarantined email

Products

• Email Security.cloud

Issue/Introduction

Using Administrator Quarantine in Email Security.cloud, you can release messages that have been quarantined in the last 30 days. Messages are sent to Administrator Quarantine because they contain malware detected by a Scan-time Protection Policy or by the Anti-Malware service.

Environment

Email Security.cloud

Resolution

Administrator Quarantine displays messages in a table format, with search criteria in the left panel. The default on first use is to display no quarantined emails. You can search quarantined emails from the past 30 days and display those that fit your criteria.

After you select the emails that you want to release, you can specify whether to release them to the message’s original recipient, or to an alternate email address that you specify. If your criteria match a larger number of messages than can be displayed on a single screen, you can choose to release all of the messages at once rather than scrolling through each screen to select and release the emails.

 

• Navigate to

  Tools > 

  Email Quarantine for Administrators

  .

  If you can't view this page, ensure that you have the proper permissions. To view quarantined messages, you must have

  View Configuration

  and

  View Statistics

  permissions for the Administrator Quarantine service. To release or rescan quarantined messages, you must have

  Edit Configuration

  permission for the Administrator Quarantine service.
• Use the left panel to select search criteria for the emails that you want to release (Time Range, Direction, Domain, and so on), and click

  Search

  .

  Messages that match your search criteria appear.
• Select the messages to release using the check boxes to the left of each quarantined message.
• Click the

  Release

  icon that is located at the top right of the screen. The

  Release Emails

  dialog appears.
• Specify whether you want to release emails to their original recipient, or to an administrator. If you select Administrator, a text field appears. Enter an administrator email address.
   

Note : The administrator email address must belong to a domain that your organization owns.

• The
  Release Emails
  dialog displays the total number of emails you have selected for release. It also provides information about probable malware infection, legal liability, and how emails are formatted after release.
• Review this information and then click the

  Release 

  button. The messages are released from Administrator Quarantine. When you release a quarantined email, it is released directly to the recipient in the form of a zipped attachment, rather than from a mail tower in the ESS infrastructure. For this reason, you cannot use the Track and Trace tool to monitor messages that are released from quarantine. Instead, use the

   Email Detailed Report

  . In the portal, on the Reports Wizard's

   Select Data 

  screen, navigate to

  Email Data 

  Email Detailed Report (CSV)

  Anti-Malware

  .