Releasing incidents

This option is only available for blocked incidents sent from the protector or Forcepoint Email Security module—that is, for email transactions that have been quarantined. It is not supported for Forcepoint Email Security Cloud.

If an SMTP email transaction was quarantined, the administrator responsible for handling this incident can release this incident to the recipients originally blocked from receiving the content. The quarantined email must be released within 1 week. After that, the message expires and can no longer be released.

All messages are released through the configured release gateway. You configure the release gateway at Settings > General > Remediation. By default, the release gateway is the agent that delivered the message to the policy engine for analysis (the protector MTA or Forcepoint Email Security).

There are 2 ways to release an incident: From the Incident Details report or By replying to the notification message.