Skip to main content

Platform

Taking Action on an Incident

Taking action on an incident is also known as remediating an incident.

  1. Locate the incident you wish to take action on. See Viewing an Incident and go to the Incident Summary page.

    The message header displays details about the incident, and its current status:

    PT-Message-Header-Incident-Summary.jpg
  2. From the Actions menu, select an action to take on this incident.

    Note

    When you select one of the following actions for an email or domain, it is applied to all affected users. Select the Affected Users tab to see a list of all users that received the email.

    • Allow Sender: This action adds the sender to the Allow List. The email is delivered to the user's inbox without analysis. See Adding a Sender to the Allow List for additional information.

    • Allow Domain: This action adds the domain to the Allow List, so that any email using that domain is delivered to the user's inbox without analysis. See Adding a Domain to the Allow List for additional information.

    • Mark as Safe: This action adds a green banner to this email marking it as safe. The email is delivered to the user's inbox.

    • Remediate: This action moves this email from a user's inbox to their Junk folder.