Remediation Reports Page

The Remediation Report page displays the remediation results of messages attempted for remediation using Mailbox Auto Remediation and Mailbox Search and Remediate.

On the Security Mangament appliance, click the Monitoring tab and select Mail Flow Summary > User Reports > Remediation Report.

You can use this report to:

  • View the messages attempted for remediation using Mailbox Auto Remediation and Mailbox Search and Remediate.

  • Know the reason for remediation failure. For example, connections errors, authentication errors, and so on.

The following list explains the various sections on the Remediation Report page:

Details on the Remediation Reports Page

Section

Description

Summary

The Summary section displays the following:

  • Total number of messages attempted for remediation using Mailbox Auto Remediation and Mailbox Search and Remediate.

  • Number of messages successfully remediated for a configured remedial action.

  • Number of messages for which the remediation failed.

Mailbox Auto Remediation

The Mailbox Auto Remediation report section displays the following:

  • A list of recipients for whom the mailbox remediation was successful or unsuccessful.

  • Remedial actions taken on messages.

  • The filenames associated with a SHA-256 hash. Click the SHA-256 hash to view the related messages in the Message Tracking page.

  • A list of profile names defined for the recipients for whom the mailbox remediation was successful or unsuccessful.

  • Reason for the remediation failure.

Note

After upgrading to AsyncOS 13.6.1, the message tracking status of the messages received before the upgrade remains as "Delivered" than "Remediated."

Email Threat Defense Remediation

The Email Threat Defense Remediation report section displays the following details:

  • A list of Email Threat Defense verdict remediated messages.

  • The message ID of each message. Click the Message ID to view more details on the Message Tracking page.

  • Email Threat Defense Verdict.

  • Action taken on the messages - forward, delete, or forward and delete.

  • A list of profile names defined for the recipients.

  • Time when the action was taken.

  • Reason for the Email Threat Defense Remediation failure (if any).

Mailbox Search and Remediate

The Mailbox Search and Remediate section displays the following details:

  • The list of remediation batches that are in progress or completed.

  • The remediation status of the messages in the batches.

  • The batch name and batch ID. Click the batch name to view the batch details:

    • The date and time when the remediation was initiated.

    • The source from which the remediation was initiated.

    • The host who initiated the remediation of the messages.

    • The remedial action taken on the messages.

    • The Cisco Ironport Message ID of the message.

    • A read receipt icon to show if the message was read by the recipient before the message was remediated successfully.

    • The remediation status of the message in the particular batch as Success, Failed, or In Progress.

    • The email address of the sender who sent the message.

    • The email addresses of the recipients for whom the message was delivered and later attempted for remediation.

    • The date and time when the message was sent to the recipient.