Team: Huntress Email Security
Product: Email Security (ES)
Summary: Learn how Historical Ingestion and Passive Mode establish an accurate baseline during onboarding before automated enforcement begins.
In this Article
Overview
Historical Ingestion
Passive Mode
Enforcement
Timeline Expectations
Overview
When you first connect Email Security (ES) to a tenant, the product does not immediately begin removing messages. Onboarding runs through two stages designed to establish an accurate baseline before taking any action:
Historical Ingestion: ES analyzes your recent mail history to show what it would have caught.
Passive Mode: ES analyzes live mail and flags findings without remediating, so you can tune the system before enforcement.
Only after these stages do you move to Enforcement, where automatic remediation is active.
Historical Ingestion
Historical Ingestion runs automatically as part of onboarding. ES pulls down your recent message history across all protected mailboxes and runs every message through its detection rules—the same rules that evaluate live mail.
Ingestion window: Approximately 90 days.
Scope: All mailboxes in the tenant, not a sample.
You do not need to do anything to start this process.
Why It Matters
Historical Ingestion serves three purposes:
It proves value immediately. Instead of waiting weeks to see whether ES catches anything, you see what is already sitting in your end users' inboxes on day one.
It surfaces active threats. Historical Ingestion routinely finds real, unremediated attacks that were delivered before you connected ES. These require investigation, not just acknowledgment.
It establishes the tuning baseline. You can resolve every false positive that surfaces before turning on enforcement, rather than after it disrupts an end user.
Reading the Results
When Historical Ingestion completes, ES presents a summary of what it analyzed and how it classified those messages. A result reads roughly like:
400 messages ingested — 300 clean, 25 classified as junk or spam, 75 classified as malicious.
Alongside the summary, you see a breakdown of the most targeted mailboxes in the tenant. This breakdown is useful for identifying which end users hackers focus on and where additional training or controls might be warranted.
What to Do With the Results
Work through the findings in this priority order:
| Priority | Finding Type | Action |
| 1 | True positives — correctly identified malicious messages still sitting in inboxes. | Investigate immediately. These might represent an active compromise. Remediate. |
| 2 | False positives — legitimate mail incorrectly flagged. | Create an exclusion for the known-good pattern so it does not recur under enforcement. |
| 3 | False negatives — malicious messages ES didn't flag. | Report them so detection coverage can improve. |
Microsoft 365 Prerequisite: Safe Attachments
If the tenant uses Microsoft Defender Safe Attachments, check the policy configuration. Safe Attachments set to Dynamic Delivery interferes with ES scanning. We recommend setting this to Block.
Verify this before or during onboarding rather than after enforcement. The symptom of improper configuration, incomplete attachment analysis, is not obvious from the dashboard.
Before You Start: Phishing Simulation Traffic
If the tenant runs phishing simulations, configure an exclusion for the simulation provider before enforcement. Without it, simulation emails are flagged as real attacks, trigger remediation, and break the simulation.
Sublime ships pre-built exclusions for KnowBe4, Cofense, Proofpoint Security Awareness, HoxHunt, Microsoft Defender Attack Simulation, NINJIO, BullPhish, Adaptive Security, and Fable Security. They are inactive by default; you simply need to enable them.
Passive Mode
After Historical Ingestion, ES enters a brief Passive Mode. Here, ES analyzes live mail and flags what it considers malicious, but it does not take remediation actions. ES removes nothing from any inbox.
Purpose: To catch environment-specific false positives on live traffic before automated remediation is active. Every organization has legitimate mail that looks unusual: a vendor's invoicing system, an internal notification tool, or a marketing platform sending on your behalf. Passive Mode surfaces these safely.
- Duration: 7 days from the time Historical Ingestion completes. After 7 days, ES automatically transitions the tenant to Enforcement. From the Email Security dashboard, you can change this per tenant:
- Activate Enforcement now to skip the rest of Passive Mode and begin remediating immediately.
- Opt out of automatic Enforcement to stay in Passive Mode indefinitely and enable Enforcement when you're ready.
What to do: Review flagged messages daily and create exclusions for anything legitimate. The quality of this review directly determines how smooth enforcement will be.
Enforcement
Once Passive Mode ends, ES begins automatically remediating high-confidence detections. The platform removes malicious messages from end users' inboxes and holds them where you can release them if needed.
See Remediation and Quarantine in Email Security for details on what happens to a remediated message and how to release one.