3.6 Quarantine configuration

Quarantining emails

Quarantining rules may be set at security rules. For details about security rules see 4.2 Security rules.

For general information about quarantine and information about operating quarantine see 4.3 Quarantine.

Blocked emails

Create or modify a security rule under Policy > Security rules. On the ACTIONS tab in the IF CONTENT IS BLOCKED section select QUARANTINE ORIGINAL EMAIL to quarantine blocked emails.

Emails can only be blocked –and as so quarantined– if scanning is enabled for the appropriate security rule when creating or modifying a security rule under Policy > Security rules on the SCAN tab.

images/download/attachments/35749882/image2019-5-20_13-36-4.png

Sanitized emails

Create or modify a security rule under Policy > Security rules. On the ACTIONS tab in the IF CONTENT IS SANITIZED section select QUARANTINE ORIGINAL EMAIL to quarantine sanitized emails.

Emails can only be sanitized –and as so quarantined– if scanning is enabled for the appropriate security rule when creating or modifying a security rule under Policy > Security rules on the SCAN tab.

images/download/attachments/35749882/image2019-5-20_13-42-7.png

Quarantine reports

MetaDefender Email Gateway Security can be configured to periodically send reports about the quarantine status.

Under Settings > Quarantine reports the following properties can be configured:

  1. SCHEDULE: the frequency of the reports

    Time and date values below are calculated in the MetaDefender Email Gateway Security server's time.

    1. OFF: no reports are sent

    2. HOURLY: a report is sent at every o'clock

    3. DAILY: a report is sent every day, at midday

    4. WEEKLY: a report is sent every Monday, at midday

    5. MONTHLY: a report is sent on the first day of every month, at midday

  2. SENDER ADDRESS: the email address from which the report is sent

  3. RECIPIENTS: email address of recipients to whom the report is sent

  4. SUBJECT: subject of the report email

  5. RULES: the digest email may be restricted to inbound or outbound quarantined items only

    1. ALL: all quarantined emails are reported

    2. INBOUND: only inbound quarantined emails are reported (emails that were matched by a rule set as INBOUND)

    3. OUTBOUND: only outbound quarantined emails are reported (emails that were matched by a rule set as OUTBOUND)

  6. ONLY INCLUDE QUARANTINED EMAILS THAT WERE BLOCKED: when this option is enabled emails which got quarantined because they were sanitized will not be listed in the quarantine report

Quarantine report limitation

Quarantine report will not contain more than 1000 entries. If there were more than 1000 new quarantined entries since the last quarantine report you will have to check the actual quarantine for more information. If you set a restriction for reporting only blocked emails and/or reporting only inbound/outbound emails the numbers and entries in the quarantine report will reflect those options.

images/download/attachments/35749882/Screenshot_from_2018-04-05_10-42-48.png

Currently the same settings (e.g. schedule) apply for all the quarantine report recipients.