Releasing incidents

Administrator Help | Forcepoint DLP | Version 8.8.2

This option is only available for blocked incidents sent from the protector or Forcepoint Email Security module—that is, for email transactions that have been quarantined. It is not supported for Forcepoint Email Security Cloud.

If an SMTP email transaction was quarantined, the administrator responsible for handling this incident can release this incident to the recipients originally blocked from receiving the content. The quarantined email must be released within 1 week. After that, the message expires and can no longer be released.

All messages are released through the configured release gateway. You configure the release gateway at Settings > General > Remediation. By default, the release gateway is the agent that delivered the message to the policy engine for analysis (the protector MTA or Forcepoint Email Security).

There are 2 ways to release an incident: From the Incident Details report or By replying to the notification message.

From the Incident Details report

Select the incident or incidents you want to release.

From the toolbar, select Remediate > Release.

A confirmation screen appears. Add comments to the release operation if desired. Comments are displayed on the History tab of the incident forensics.

Click OK.

For mobile incidents, you're asked to select the users to release the message to. (Many users may have had the same message blocked when they synchronized their email to their mobile devices.) You can release the blocked message to all users who tried to sync it, or to selected users. If desired, you can release the message to everyone who syncs this message in the future.

If the system is set up to do so, an email message is sent to all configured recipients notifying them that incidents were released from the incident database.

The release status (success or failure) is also logged in the Audit Log.

By replying to the notification message

When an email incident is blocked, or indeed any policy breach is discovered, notifications are sent to all the users configured in Main > Policy Management > Resources > Notifications. Users can release email incident by replying to the notification message.

If the message was successfully released, the user who released the message receives a confirmation email.

See Releasing email blocked by Forcepoint DLP on the Forcepoint support site for information on configuring the release gateway and Microsoft Exchange or Active Directory settings.