You can remediate retroactively detected emails and delivered clean emails manually using the CLI.
Prerequisites
Administrator or Operator access to the Email Security - Server appliance.
A connection to the Email Security - Server appliance.
Microsoft Office 365 app communication and authorization.
Go to CLI configuration mode:
hostname > enable hostname # configure terminal
View retroactively detected malicious emails or delivered clean emails and retrieve the queue ID of missed emails from a specified period or from a specified sender to a specified recipient.
Email for a specified period:
hostname (config) # show email-analysis missed from <start-date> <start-time> to <end-date> <end-time>
-------------------------------------------------------------------------------- Missed Email(s): ----------------------------------------------------------------------------------- Queue_ID Date From To Subject 486hqK0YbHz1TGfT 28 Jan 2020 17:58:21 Sender@acme.com Receiver@acme.com welcome 486hmk15Hhz1TGfT 28 Jan 2020 17:56:06 Sender@acme.com Receiver@acme.com welcome
Missed email from a specified sender to a specified recipient:
hostname (config) # show email-analysis missed from-email-id <sender-email-address> to-email-id <recipient-email-address> ------------------------------------------------------------------------------ Missed Email(s): ---------------------------------------------------------------------------------- Queue_ID Date From To Subject 486hqK0YbHz1TGfT 28 Jan 2020 17:58:21 Sender@acme.com Receiver@acme.com welcome 486hmk15Hhz1TGfT 28 Jan 2020 17:56:06 Sender@acme.com Receiver@acme.com welcome
Enter the queue ID of the missed email or delivered clean email to delete or quarantine based on the configuration in the WebUI or using the
email-analysis o365 remediation policycommand in the CLI.hostname (config) # email-analysis remediation queue-id <queue-id>