Viewing Email Actions

The Respond | Actions | Email Actions tab displays the actions taken manually from the Event Display in response to a detected threat in email traffic. See Creating Remediation Email.

Revert is not applicable for Email actions

See the Tables page for more information on working with tables.

The Status can be:

Waiting–The action is queued. This should take less than a minute.
In Progress – The action is being communicated to the connector.
Succeeded – The action was successfully implemented.
Failed – The action failed. An Error Message relayed from the connector provides details.
Expiring – The action is being removed from the connector.
Expired – The action is no longer active.

Automated Threat Hunting (ATH) email actions do not show in this table. See Last Status in Automated Threat Hunting for details.