Viewing Email Actions

The Respond | Actions | Email Actions tab displays the actions taken manually from the Event Display in response to a detected threat in email traffic. See Creating Remediation Email.

Revert is not applicable for Email actions

See the Tables page for more information on working with tables.

The Status can be:

Waiting–The action is queued. This should take less than a minute.
In Progress – The action is being communicated to the connector.
Succeeded – The action was successfully implemented.
Failed – The action failed. An Error Message relayed from the connector provides details.
Expiring – The action is being removed from the connector.
Expired – The action is no longer active.
Action succeeded on second try – Under certain circumstances, an email may not be delivered by the mail server on the first try. In cases such as this, ATH attempts to send the email a second time and, if successful, lists the action here with this message.