When a threat is detected by Inbound Shield, admins have an option of automatically sending notifications to the recipient of the email, the reviewer team, or both. This can be selected from the “Secondary actions” menu under any section of the “Threat Prevention Rules” section.
By clicking on the “Notification Options” button, you can configure when recipients and reviewers should receive notifications of quarantined emails.
To configure, open the “Select notification timing” menu for reviewers/recipients and select one or more of the following options:
Immediate Notifications
When “Notify immediately” is selected, reviewers or recipients will receive a separate notification for each threat as it comes in. The notification sent to the reviewer will look similar to this:
This notification contains extensive information about the email that was quarantined, as well as a link to review the full email threat analysis and take actions such as releasing the email or blocklisting the sender.
Note: Immediate notifications sent to recipients will appear similar, but by default recipients will not be able to review and take actions on their own quarantined emails.
You can grant recipients permissions to review and take actions on their own quarantined emails (with the exception of malicious emails) by selecting “Allow recipient control” in the threat prevention rules. More information here - https://docs.trustifi.com/docs/threat-prevention-rules
Scheduled Notifications
You may also choose to receive scheduled, aggregate reports of threats and quarantined emails at predetermined times. The available options are:
Every hour
Every 3 hours
Every 6 hours
Every 8 hours
Custom notification times
These aggregate reports will be sent in the format of a table, divided into threat categories such as “Malicious” and “Spam”. Each quarantined email will be displayed in a separate row and available actions will be on the right end of the row.
Custom Notification Times
When choosing the “Custom notification times” option, you can select the specific hours of the day at which quarantined email reports should be sent to recipients or reviewers.
In the example pictured below, for both reviewers and recipients, notifications will be scheduled to arrive at 9 am and 2 pm.
Note: Scheduled notifications will be sent according to the user’s own local time.
By default only admins and reviewers can set custom notification times, however this setting can be enabled for end users by checking the box for “Allow users to set their own custom notification times”.
When this setting is enabled, users can configure their own quarantine notifications settings by going to their personal inbound quarantine page in the Trustifi portal and clicking on the “Quarantine Notifications” button.
Message for Recipients
The “Add message” field under the “Notify Recipient” section allows admins to add a custom message to recipient quarantine reports.
This message may contain, for example, further information about how to handle possible threats or who to contact to release quarantined emails.
The message can be added in plain text format or as HTML.
Release Requests
When recipients cannot release their own quarantined emails, e.g. when the email was detected as “Malicious”, admins can allow recipients to submit a request for the reviewer team to release this email.
This can be done by selecting the “Allow recipients to request release” check box.
In addition, you can customize some aspects of the release request email:
“Send the release request to:” (input, optional): Here you can specify which admin/reviewer should receive the automated requests to release quarantined emails. If this field is empty, these requests will automatically be sent to the primary reviewer.
“Release request email title” (input, optional): Allows you to customize the subject line of “Release request” emails. As listed in the example, you may also use dynamic fields to add information about the sender or the email. For example, {{RECIPIENT_EMAIL}} will add the email address of the recipient who received the quarantined email.
“Use “from” address of the recipient” (checkbox, optional): Release requests are sent, by default, from the Trustifi Service mailbox on behalf of the user who requested the release. When this box is checked, the release request will show the “from” identity as that of the user requesting the release instead of Trustifi Service.