Email remediation actions

Perform the remediation action on the email quarantined for Proofpoint.

Before you begin

Proofpoint provides four remediation actions:

1. Release Email with Scan
2. Release Email without Scan
3. Release Encrypted Email with Scan
4. Delete Email

By default, Release Email with Scan, Release Email without Scan, Release Encrypted Email with Scan, and Delete Email response options and Proofpoint Remediation Action Rule to perform the remediation action on the email. These response options also have the Proofpoint Email Release Approval Rule configured with it to leverage the approval functionality for these actions. These remediation actions are available to the End Users, Analysts, Escalated Incident Reviewers for execution.

For more information, see Set up incident response option rules for your DLP incidents, Configure response option for your DLP incidents, and Configure Approval Rules.

Role required:

• sn_dlir.admin
• sn_dlir.analyst

Figure 1. Proofpoint Quarantine Release Response Option Rule

Figure 2. Proofpoint Quarantine Release Response Option Mappings

Procedure

The following procedure explains how to submit the remediation action from the DLP Analyst Workspace. As a DLP Admin and DLP Analyst, you can:

1. Navigate to All > DLP Incident Management > DLP Analyst Workspace.
2. Open any Proofpoint DLP incident with Scan source as Email SMTP.
3. Click Respond.
4. Select the response option from the Response drop down list.
5. Click Submit.

The following procedure explains how to submit the remediation action from the DLP User Workspace. As an end user, you can:

6. Navigate to All > DLP Incident Management > DLP Analyst Workspace.
7. Open any Proofpoint DLP incident with Scan source as Email SMTP.
8. Click Respond.
9. Select the response option from the Response drop down list.
10. Click Submit.
    Note:

    • When an approval rule is configured for this action, the approval flow will be triggered first and after receiving all the approvals, the email remediation flow will be triggered, and then the action will be performed.
    • If Delete Email is performed, then the state of the DLP incident is updated to Delete File. For any other response option, the DLP incident state will be updated to Released Email from Quarantine after the email is successfully released.