Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Viewing Incidents and Reports > Viewing the incident list > Remediating incidents > Releasing incidents
Releasing incidents
Administrator Help | Forcepoint DLP | Version 8.5.x
This option is only available for blocked incidents sent from the mobile agent, protector, or Forcepoint Email Security module—that is, for email transactions that have been quarantined.
If an SMTP email transaction was quarantined, the administrator responsible for handling this incident can release this incident to the recipients originally blocked from receiving the content.
All messages are released through the configured release gateway. You configure the release gateway at Settings > General > Remediation. By default, the release gateway is the agent that delivered the message to the policy engine for analysis (the mobile agent, protector MTA, or Forcepoint Email Security).
There are 2 ways to release an incident: From the Incident Details report or By replying to the notification message.
From the Incident Details report
1.
Select the incident or incidents you want to release.
2.
From the toolbar, select Remediate > Release.
3.
A confirmation screen appears. Add comments to the release operation if desired. Comments are displayed on the History tab of the incident forensics.
4.
Click OK.
For mobile incidents, you're asked to select the users to release the message to. (Many users may have had the same message blocked when they synchronized their email to their mobile devices.) You can release the blocked message to all users who tried to sync it, or to selected users. If desired, you can release the message to everyone who syncs this message in the future.
If the system is set up to do so, an email message is sent to all configured recipients notifying them that incidents were released from the incident database.
The release status (success or failure) is also logged in the Audit Log.
By replying to the notification message
When an email incident is blocked, or indeed any policy breach is discovered, notifications are sent to all the users configured in Main > Policy Management > Resources > Notifications. Users can release email incident by replying to the notification message.
If the message was successfully released, the user who released the message receives a confirmation email.
See the knowledge base article, Releasing email blocked by Forcepoint DLP, for information on configuring the release gateway and Microsoft Exchange or Active Directory settings.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Viewing Incidents and Reports > Viewing the incident list > Remediating incidents > Releasing incidents
Copyright 2017 Forcepoint. All rights reserved.