Request Release

The Request Release feature allows end-users to request the release of emails in their Self-Service Quarantine (SSQ). Analysts can then review these requests and decide whether to release or deny them. How it works:

The feature must be enabled separately for each quarantine
It only applies to quarantines where end-users do not already have release permissions
To enable it, add canRequestRelease: true to a quarantine in the guarded_tenants.yml file via the Expert Editor

For example, this configuration in guarded_tenants.yml enables the feature for the Phishing quarantine.

tenants:
  - uid: 00000000-0000-0000-0000-000000000000
    name: xorlab.com
    quarantine:
      - name: Phishing
        canView: false
        canRelease: false
        canRequestRelease: true    

End-user view

For emails in an eligible quarantine, the end-user sees a Request Release button in the upper-right corner.

After clicking the button, the email status changes to: RELEASE REQUESTED
Once an analyst reviews the request, the status updates to:
- RELEASE APPROVED – if the analyst releases the email
- RELEASE DENIED – if the analyst denies the request (the email stays in quarantine)

Analyst view

Analysts can manage release requests by:

Filtering emails by the status RELEASE REQUESTED
Opening the detail view of an email to either:
- Release the email → status changes to RELEASE APPROVED
- Deny the request → status changes to RELEASE DENIED

Saved SearchCreate a saved search for the status RELEASE REQUESTED to quickly access all pending requests.

Triggering notifications

You can configure notifications to be triggered when specific release request events occur.

audit.quarantine.release.request.created – A user has submitted a release request
audit.quarantine.release.request.approved – An analyst has approved and released the email
audit.quarantine.release.request.denied – An analyst has denied the release request

For details on configuring notifications, see Logging. You can, for example:

Send an email notification when a release request is created, using an Email Appender
Forward events to your SIEM using a Syslog Appender

​End-user view

​Analyst view

​Triggering notifications

End-user view

Analyst view

Triggering notifications