Quarantine Email Message Task

After identifying a suspicious email message, you can quarantine the message from all supported mailboxes protected by Cloud App Security using context menus on the Trend Vision One console.

1. After identifying the suspicious email message, access the context or response menu and click Quarantine Message.

   The Quarantine Message Task screen appears.

2. Confirm the targets of the response.
3. Select the mailboxes that this task applies to.
   Important:

   This task is only applicable on supported mailboxes protected by Cloud App Security.

   If the target message is not found in a supported mailbox protected by Cloud App Security or users have already deleted all instances of the message, you cannot create the task.

4. (Optional) Specify a Description for the response or event.
5. Click Create.

   Trend Vision One creates the task and displays the current command status on the Response Management app.

6. Monitor the task status.
   1. Open the Response Management app.
   2. (Optional) Locate the task using the Search field or by selecting Quarantine Message from the Action drop-down list.
   3. View the task status.

      • Pending approval () (if applicable): The automated response task was created on the Workbench app and is waiting for approval

      • Rejected () (if applicable): The automated response task created on the Workbench app was rejected

      • In progress... (): Trend Vision One sent the command to the managing server and is waiting for a response

      • Successful (): The managing server successfully received the command

      • Partially successful (): One or more of the tasks was unsuccessful

      • Unsuccessful (): An error or time-out occurred when attempting to send the command to the managing server, the Security Agent is offline for more than 24 hours, or the command execution timed out

      • Action taken by Cloud App Security(): The email message has already been deleted or quarantined by Cloud App Security. Go to Cloud App Security to learn more.

   If you determine that a quarantined message is malicious, you can delete the message using context menus on the Trend Vision One console.

   After determining that a quarantined message is not malicious, you can restore the message by clicking Restore message on the task context menu..

   For more information, see Delete Email Message Task.