Actions And Remediation

A high-confidence malware rule fires on a delivered message. Operator must decide between auto-removing it from the mailbox and routing to an analyst review queue.

Bind the action to confidence: high-confidence malicious detections auto-remediate (move/remove from the mailbox) to cut dwell time, while ambiguous detections route to a review queue for human disposition. Auto-action only where the rule's precision justifies the false-positive cost of removing re…

A medium-confidence look-alike-domain rule fires. Operator considers injecting a recipient warning banner instead of removing the message.

For medium-confidence detections, prefer a non-destructive intervention (a recipient warning banner / label) over removal, so the user gets context without losing a possibly-legitimate message. Reserve removal for high confidence. Confirm which non-destructive actions the integration supports. [REQ…

When a VIP/executive mailbox is targeted by a high-severity detection, the SOC should be paged, but routine bulk-spam removals should not page anyone.

Gate notifications/escalation on severity and target sensitivity: page or ticket on high-severity VIP-targeting detections, and keep routine bulk remediation silent to avoid alert fatigue. Route escalations through the operator's existing on-call (webhook/SIEM/ticketing) rather than email-only. [RE…