Question about AMP Quarantine on the Cisco ESA / SEG

[Amen]

we've activated AMP incl. File Analysis on our Cisco SEGs. However we're a bit concerned about the understanding of the "File Analysis" Quarantine and the time frame which we should use for releasing messages. For sure we want to reduce the delay of incoming emails to a minimum.
Is there some kind of a best practice documentation about this feature? 

[Ken Stieers]

Default is 10 minutes, which works for us.
You want to give TG time to actually execute the file and let it do its thing.

You want have Mailbox Automatic Remediation configured so if its released, and gets marked bad later, the ESA can pull it from the mailbox.

[Amen]

ok, at the moment we’ve configured it to 15 minutes and don’t face any issues.

Do you think we should reduce it to 10 minutes or stick with the 15 minutes?

Would there be any benefit to go for 10 compared to 15 minutes?