Many phishing attacks utilize the same or similar content and templates. In the Defend console, you can use the Operations tab to remediate dangerous emails from user inboxes or restore previously remediated emails if they are found to be safe.

The Email Match Confidence score can be used to remediate or restore all exact matches and similar emails.

Remediate Phishing Emails

Remediation allows you to remove malicious emails from one or multiple user inboxes simultaneously. To remediate emails, follow the steps below:

1. Log in to the Defend console.
2. Navigate to the Recent Emails tab.
3. Select the phishing email you wish to remediate.
4. Select the Operations tab.

5. Use the Threat Remediation property filters to find exact or similar matches. The Email Match Confidence score decreases as you deselect the property filters.

   

6. Identify and select the emails you wish to remediate.
7. Select Remediate Selected Emails.

When you remediate emails, you will have the option to receive a notification if remediation fails or automatically set the remediation status to Completed—Phish upon successful remediation.

Restoring Remediated Emails

Previously remediated emails can be restored and returned to the user’s inbox. This restore functionality applies to both manual and auto remediations. To restore emails, follow the steps below:

1. Log in to the Defend console.
2. Navigate to the Recent Emails tab.
3. Select the remediated email you wish to restore.
4. Select the Operations tab.
5. You can choose to restore specific emails or all emails that match the current criteria.

Considerations

The ability to restore depends on your Defend system deployment type and the location of the remediated email or the mechanism used to remediate the email. The possible Defend deployment types are Post-Delivery Analysis (SMTP) and Pre-Delivery Analysis (Graph API).

For Post-Delivery Analysis, the ability to restore based on the remediation mechanism is highlighted below. 

*Restoring may be possible depending on your Microsoft configuration.

For Pre-Delivery Analysis, the ability to restore based on the remediation email location is highlighted below. 

*Restoring may be possible depending on your Microsoft configuration.