Hi,
the message will be sent to the Outbreak Quarantine if the threat level for a message equals or exceeds the threshold you configured in below Step1, (1=lowest threat, 5=highest threat)
>Step1: configure retention that the messages stay in the Outbreak Quarantine
path: Mail Policies>Incoming Mail Policies>edit 'Outbreak Filter' in one of policy
Here, you can specify the 'Quarantine Threat Level' and the maximum amount of time that messages stay in the Outbreak Quarantine. You can specify different retention times for messages that may contain viral attachments and messages that may contain other threats, like phishing or malware links.
>Step2:configure what action performed on messages in outbreak quarantine
path: Monitor>Policy, Virus and Outbreak Quarantines>Outbreak
1. There are two primary default actions:
- Delete—The message is deleted.
- Release—The message is released for delivery (When a message is released from all queues in which is has been quarantined rescanning occurs, Messages released from the Outbreak quarantine are rescanned by the anti-spam, AMP, and anti-virus engines.)
2. Messages are automatically removed from the quarantine under the following circumstances,When a message is automatically removed from a quarantine, the default action is performed on that message:
- Normal Expiration—the configured retention time is met for a message in the quarantine
- Early Expiration—messages are forced from quarantines before the configured retention time is reached. This can happen when:
The size limit for all quarantines - You delete a quarantine that still holds messages.
