Hello,sometimes we see, even AMP has identified an attachment as "malicious", the mail is delivered to the user's inbox from the AMP quarantine on SMA. There is no indication of the behavior in the logs (per-day limit is also not reached at this time...