Quarantine

Overview

Quarantine is an Enterprise Action that makes messages inaccessible to mailbox end users, thus preventing interaction with malicious message bodies, links, or attachments.

In Microsoft 365 environments, quarantined messages are pulled from the inbox, "cleaned" of its content by Sublime, and placed in the recoverable trash folder as a stub with the subject line. Mailbox users are not able to access the message's contents that Sublime removed.

In Google Workspace environments, quarantined messages are completely inaccessible. There is no stub created in the trash folder!

Add Quarantine to Rules for automated blocking

1. Click "Detection" or “Triage” in the left nav of your Dashboard
2. Click on the Rule you wish to add the action to, opening the detail view for this Rule
3. Click "Edit" or "Edit Metadata" in the top right of this detail view
4. Click the "Actions" dropdown and select your Quarantine Action
5. Click "Save Rule"

Manually quarantine a message

1. While viewing the message on the Dashboard, select the "Quarantine" option in the review flow.
2. Optionally add a custom Action, review label, comment, and the Share with Sublime check.
3. Submit your review!

Note: You can quarantine a message using the Quarantine API instead! Check out how here.

Restore a quarantined message

1. While viewing the message on the Dashboard, select the "Restore from Quarantine" option in the review flow.
2. Optionally add a custom Action, review label, comment, and the Share with Sublime check.
3. Submit your review!

Note: You can restore a quarantined a message using the Restore API instead! Check out how here.