Email Quarantine - information

[Justin_W]

Hey all.

As an admin for our GWFE, I occasionally get notifications of email that ends up in our quarantine.

Today I got one that I wanted to look a bit closer at - so I head to the Quarantine area in our Dashboard.

I'm looking at the email in question and it looks fairly legit. I do also see that it has a PFD attached.

What I don't see is a real explanation as to WHY is was quarantined.  

The only rule/quarantine we have setup is the default one.  When I click to "edit" that quarantine, there's really not much there other than settings to send a reject message or not.

Looking at the email from  the quarantine, under the "matched rules" heading it simply says "Rule description" - which I assume is because the description is blank for the default quarantine. 

So I assume my answer lies somewhere else.  

Where do I see WHY a message was sent to quarantine?  Surely if the sender/attachment or some other item was suspicious/infected there'd be a more clear indication of that, correct?

My only options are to allow or reject it - but I don't feel like I want to take action on it without further details about WHY it was quarantined in the first place. 

[Dean_Mantz]

@Justin_W When you open an email in Quarantine and review it, look just below the section displaying the date/from/to/message/subject for the wording of "Matched Rules".  Use the arrow just to the left of that title to expand and review the rule description.  

[Dean_Mantz]

Sorry, I didn't associate your last part of the post when you shared what the "Matched Rules" displayed.  I know we have a rule to filter attachments as well as look for certain terms like slang/inappropriate words. 

[Justin_W]

Where are these rules defined? Maybe that is where the answer is. I'm not seeing that cleary under the Quarantine area. 

[Kim_Nilsson]

I don't think any rules are in the Quarantine section.

You find the rules in Gmail Compliance and Gmail Safety.

At least that's my guess. I have never used the Quarantine (nor ever felt the need), and instead send everything to my users, with warnings from the Safety settings, and we don't have any Compliance rules for words.

[Justin_W]

Thanks.

I guess I'll have to set aside a chunk of time to fish through all the settings to see what might be set to send something to the quarantine.  Odd that it's not just linked/referenced to from the quarantine itself.