Team: Huntress Email Security (ES)
Product: Email Security 
Environment: Microsoft 365, Google Workspace 
Summary: This article explains what remediation and quarantine mean in Email Security, where removed messages go, and how to restore them to the user.

In this Article

Overview
Remediation and Quarantine Are the Same Thing
Where Remediated Messages Go
Releasing a Message
After Releasing
Campaign-Wide Remediation
Other Actions
Quarantine Digests

Overview

When Email Security (ES) determines that a message is malicious, it removes it from the recipient's inbox. This article explains what "remediation" and "quarantine" mean in ES, where remediated messages go, and how to release one if it was flagged in error.

Remediation and Quarantine Are the Same Thing

You will see both terms used. They refer to the same action:

• Quarantine is the underlying action name in the Sublime platform.

• Remediate is the term Huntress uses, consistent with how remediation is described across the Huntress platform.

When ES remediates a message, it quarantines it. The message is pulled from the user's inbox and placed in a state where the user can't access or interact with it, but it isn't permanently destroyed. It can be released if the detection was a false positive.

Key point for partner conversations: Remediation is reversible. Nothing is lost. A message that should not have been removed can be restored to the user's inbox.

Where Remediated Messages Go

Behavior varies by email platform.
 

Microsoft 365

Quarantined messages are moved to the Recoverable Items \ Purges folder of the mailbox. Users can't see or access this folder.

Messages remain restorable by administrators for 14 days by default. This retention period is set by your Exchange deleted item retention configuration, not by ES, and can be adjusted in the Exchange Admin Center.

Important: The clock starts at delivery, not at quarantine. The 14 days are counted from when the message was received, not from when ES quarantined it. This matters for retroactive remediation: if ES removes a message that was delivered 12 days ago, you have two days left to restore it, not 14. For older messages remediated during Historical Ingestion, the restore window might already have closed.

Google Workspace

Quarantined messages are deleted from the user's mailbox and are completely inaccessible to the mailbox owner. However, they should remain restorable through ES. 

Calendar Events

If a remediated message carried a calendar invitation, the associated calendar event is removed along with the message.

When a message is restored, its calendar events are recreated as placeholder events. Placeholders point users back to the original invitation for full details and to RSVP, and do not include the original organizer or invitee list. This prevents duplicate or stale invitations from being sent to attendees.

Releasing a Message

If a legitimate message was remediated, you can release it back to the inbox.

1. Log in to Huntress and go to the Email Security dashboard.

2. Locate the message you want to release.

3. Select the restore option in the message review flow.

4. (Optional) Add a review label or comment documenting why it was released.

5. Submit the review.

The message is returned to the recipient's inbox. 

After Releasing

Releasing a single message resolves the immediate problem but does not prevent a recurrence. If the same legitimate sender or pattern is likely to be flagged again, create an exclusion so future messages are not remediated. 

Campaign-Wide Remediation

ES groups related messages into a single attack campaign. When a message in a group is remediated, ES can act on every message in that group across all affected mailboxes at once, including messages delivered before the threat was identified.

This is why a single user report can result in dozens of messages being removed across the organization.

Other Actions

Quarantine is not the only action available in the underlying platform. Others include moving a message to Trash, moving to Spam, and inserting a warning banner into the message body.

Quarantine Digests

The underlying platform supports sending periodic digest emails, daily or weekly, to end users, summarizing messages that were quarantined for them.

Digests are not purely informational. Users can submit a release request from the digest, which lands in a queue for an administrator to approve or deny. Access to that queue is governed by its own role permissions.