---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Email remediation actions

# Email remediation actions {#ariaid-title1}

Release version: Australia  
Updated October 26, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Perform the remediation action on the email quarantined for Proofpoint.

## Before you begin

Proofpoint provides four remediation actions:

1. Release Email with Scan
2. Release Email without Scan
3. Release Encrypted Email with Scan
4. Delete Email
{#email-actions__ol_ffj_f2w_tcc}

By default, Release Email with Scan, Release Email without Scan, Release Encrypted Email with Scan, and Delete Email response options and
Proofpoint Remediation Action Rule to perform the remediation action on the email. These response options also have the Proofpoint Remediation Action Approval Rule configured with
it to leverage the approval functionality for these actions. These remediation actions are available to the End Users, Analysts, Escalated Incident Reviewers for execution.

For more information, see [Set up incident response option rules for your DLP incidents](https://www.servicenow.com/docs/RLu4r6VrzMF9Vaxug9KjQg "Create the incident response option rules that end user or analyst can use while responding to an incident."), [Configure response option for your DLP incidents](https://www.servicenow.com/docs/1QqdESchbNTpm8Sp8oXHyQ "Use this feature to configure the type of response that an end user or analyst should perform."), and [Configure Approval Rules](https://www.servicenow.com/docs/y~1XZvQsmLOqBjkfbVKDbw "Configure approval rules that require one or more approvers to authorize an advanced response option before it is applied to a DLP incident.").  
Role required:

* sn_dlir.admin
* sn_dlir.analyst

{#email-actions__ul_yzj_zdw_tcc}Figure 1. Proofpoint Quarantine Release Response Option Rule Figure 2. Proofpoint Quarantine Release Response Option Mappings

## Procedure

The following procedure explains how to submit the remediation action from the DLP Analyst Workspace. As a DLP Admin and DLP Analyst, you can:

1. Navigate to AllDLP Incident ManagementDLP Analyst Workspace.
2. Open any Proofpoint DLP incident with Scan source as Email SMTP.
3. Click Respond.
4. Select the response option from the Response drop down list.
5. Click Submit.

The following procedure explains how to submit the remediation action from the DLP User Workspace. As an end user, you can:

6. Navigate to AllDLP Incident ManagementDLP User Workspace.
7. Open any Proofpoint DLP incident with Scan source as Email SMTP.
8. Click Respond.
9. Select the response option from the Response drop down list.
10. Click Submit.  
    Note:  
    * When an approval rule is configured for this action, the approval flow will be triggered first and after receiving all the approvals, the email remediation flow will be triggered, and then the action will be performed.
    * If Delete Email is performed, then the state of the DLP incident is updated to Delete File. For any other response option, the DLP incident state will be updated to Released Email from Quarantine after the email is successfully released.
    {#email-actions__ul_gny_qcw_tcc}

*[\>]: and then