Emails with Modified Attachments

You can view these details in the Emails with Modified Attachments page.

Emails with attachments, where the links in the attachments were replaced. See Click-Time Protection.
Emails with attachments that were cleaned. See Attachment Cleaning (Threat Extraction).

Note:

The page does not show emails where links in the email body were replaced.

Sending the Unmodified Emails to End Users

To send the original email to the end-user, do one of these.

From the Modified Attachments page

Go to User Interaction > Modified Attachments.
To send an original email, click the icon for the email from the last column of the request table and select Send Original.
To send multiple emails at a time, select the emails and click Send Original from the top-right corner of the page.
Click OK.

From the Email profile page

Open the email profile page.
In the Email Profile section, click Send for Send Original Email.
Click OK.

Dedicated Quarantine Mailbox / Folder

If you would like to store quarantined emails/files locally, you can configure a dedicated quarantine repository for every protected application. This repository is used to store every email / attachment / file that is quarantined automatically according to the policy or manually by administrators.

Specifying such a mailbox/folder is not mandatory, as Email Security stores a copy of quarantined items in an S3 bucket associated with the Check Point Portal portal.

Office 365 Mail

Note:

The dedicated quarantine mailbox must be a full licensed mailbox and it cannot be a shared mailbox.

To configure the dedicated Office 365 Mail quarantine mailbox, click Security Settings > SaaS Applications > Office 365 Mail > Configure.

Gmail

To configure the dedicated Gmail quarantine mailbox, click Security Settings > SaaS Applications > Gmail > Configure.