Alerts

When enabled, an email alert will be sent each time an email or a file is assigned a malicious scan verdict.

• The email alert is sent immediately when the scan is assigned a malicious verdict.

• The email alert can be sent to admin users, end users, or both. A similar email is sent to admin users and to end users. The admin version includes slightly more information, as well as a link to the scan in FortiMail Workspace Security.

• The email alert usually includes a screenshot preview of the original email - to help understand which email was blocked.

  Note: If the email includes a suspected malicious QR code, a preview of the email may not be available in the email alert. This is to prevent users from mistakenly accessing the potentially malicious QR code in the preview.

• The email alert is sent irrespective of whether or not the email or file was quarantined.

• Email alerts are sent to shared mailboxes as well as to ordinary main boxes.

• [Malicious emails] Email alerts are sent only when an email is scanned and then automatically assigned a malicious verdict by the system, or if the verdict is changed from clean to malicious by the FortiMail Workspace Security IR Team. If the verdict is changed from clean to malicious by an admin user, then an email alert is NOT sent.

• Email alerts are not sent in response to emails or files that are assigned a restricted or spam scan verdict.

• Email alerts are not sent for emails that were quarantined by Microsoft. [See Quarantined by Microsoft]

• For details on how to customize email alerts, see Customizing FortiMail Workspace Security.

When selected, an email alert will be sent each time an email or a file is assigned a malicious scan verdict.

[Email alerts are not sent in response to emails or files that are assigned a restricted or spam scan verdict.]

• The email alert is sent irrespective of whether or not the email or file was quarantined.

• The email alert is sent for both inbound and outbound malicious activities.

Email headers:

• Quarantined: Malicious Email has been detected and safely blocked

• Not quarantined: Malicious Email has been detected

Recipients: Defines which admin users will be sent the email alerts that are enabled above:

• All admin users: The email alerts will be sent to all FortiMail Workspace Security admin users in your organization [not to additional admin users in the parent organization]. Email alerts are sent regardless of the admin user's role. Escalation contacts are included only if they are admin users.

• Specific users: The email alerts will be sent to the specified admin-user email address or addresses.

When selected, an email alert may be sent each time a case is added to the Account Takeover page. For details about these cases, see Account Takeover.

• Severity: Defines for which severity of malicious cases alerts will be sent. This enables you to limit the number of alerts that are sent for suspected malicious cases.

• Recipients: Defines which admin users will be sent the email alerts that are defined above:

  • Same as escalation contacts: The email alerts will be sent to the escalation contacts. For details, see Escalation contacts.

  • All admin users: The email alerts will be sent to all FortiMail Workspace Security admin users in your organization [not to additional admin users in the parent organization]. Email alerts are sent regardless of the admin user's role. Escalation contacts are included only if they are admin users.

  • Same as malicious incidents: The email alerts will be sent to the recipients that are defined [above] to receive email alerts about malicious incidents.

  • Specific users: The email alerts will be sent to the specified admin-user email address or addresses.

    Limitation: All specified email addresses should be in the same domain.

An email alert will be sent each time an email or a file is assigned a malicious scan verdict.

[Email alerts are not sent in response to emails or files that are assigned a restricted or spam scan verdict.]

The email alert is sent irrespective of whether or not the email or file was quarantined.

The "warning" email will be sent to the intended recipient of the original email or to the owner of the file. The "warning" email will have the subject similar to "A malicious email has been detected and blocked"

If the recipient of the email alert thinks that the email or file is not malicious, the recipient can request their IT security team to investigate the scan - and to release the email or file from quarantine, if the email was quarantined.

When enabled, end-users who submit an investigation request using the Report Message button [Microsoft 365 Inline or API] or the Report Email button [Google Workspace] will receive a feedback alert [email] when the request is handled.

See:

• Microsoft 365 Inline or API: Configuring a Microsoft 365 "Report Message" button

• Google Workspace: Adding a Gmail "Report Email" button