Enable Release Requests

1. In Expert Editor, open shared/guarded_tenants.yml.
2. Set canRequestRelease: true and canRelease: falsefor every quarantine where you want to enable the request release. See List of Quarantines.
   tenants:
     - name: xorlab.com
       quarantine:
         quarantines:
           - name: Phishing
             canView: true
             canRelease: false
             canRequestRelease: true
   

   The feature must be enabled separately for each quarantine. It only applies to quarantines where end-users do not already have release permissions.
3. Click Publish. The new configuration becomes active within about one minute. The SSQ will then show a Request Release button for emails in the corresponding quarantines.

​

Enable request notifications

• audit.quarantine.release.request.created – A user has submitted a release request
• audit.quarantine.release.request.approved – An analyst has approved and released the email
• audit.quarantine.release.request.denied – An analyst has denied the release request

• For email notification, you can find a working example here, in the XCC tab: Enable Logging via Email
• Forward events to your SIEM using a Enable Logging via Syslog

​

Workflow