Changing Verdicts

This page includes:

About changing verdicts

Each scan that is performed on any item, is assigned a verdict by FortiMail Workspace Security. You can change the assigned verdict of a scan to any of the other available verdicts. For details on the required procedure, see How to change a verdict below.

Note: The table below applies to Microsoft 365 integrations [Inline and API] and to Google Workspace integrations only. It doesn't apply to Microsoft Exchange integrations or "Other" integrations.

Change from...	Change to...	Resulting action
Clean	Malicious	The email will be removed from the recipient’s mailbox. This will occur even if the recipient has moved the email from the Inbox to a different folder in the mailbox. The email will be quarantined. Limitation - Microsoft 365 API integrations: If the recipient has already deleted the email, then the email will remain in the Deleted Items folder or the Trash folder - and not moved to the quarantine location. The above re-locations occur only if your organization is operating in blocking mode. For details, see Quarantine mode. The above re-locations apply to Microsoft 365 integrations [Inline and API] and to Google Workspace integrations only. They don't apply to Microsoft Exchange integrations or "Other" integrations.
Clean	Spam	The email will be moved from the recipient's Inbox to the recipient’s Spam folder or Junk folder.
Malicious	Clean	If the email is in quarantine, then the email is released [removed] from quarantine and sent to the recipient's Inbox. The released email should appear immediately in the Inbox.
Spam	Clean	If the email is in the recipient’s Spam folder or Junk folder, or the email is in quarantine, then the email is moved to the recipient's Inbox. The email should appear immediately in the Inbox.

Note:

The email deletions and re-locations described above will occur only if the FortiMail Workspace Security remediation app for Microsoft 365 or Google Workspace is installed. The remedial app is typically installed as part of the onboarding process.
The remediation app is available for Microsoft 365 [Inline and API] and Google Workspace integrations only. The remediation app isn't available for Microsoft Exchange integrations or "Other" integrations.

For further details, see Remediation App.

When you change a verdict, the change is applied to the specific email only - it doesn't affect any future emails, for example, other emails coming from the sender address. To affect future emails, you'll need to add appropriate entries to the organization's allow lists and block lists,

For details on the possible verdicts, see Verdicts.

A FortiMail Workspace Security admin can also request that the FortiMail Workspace Security IR Team investigate a specific scan - and change the verdict, if necessary. For details, see Requesting an investigation.

How to change a verdict

To change the verdict that is assigned to a scan:

In FortiMail Workspace Security, in the left navigation menu, select Security Operations > Scans.
Locate and then open the scan in the Scans-details page.
Click Change verdict.
Select the required verdict, add a comment, and then click Change Verdict.

Note: You can also select multiple scans in the Scans page, and them perform a bulk change of verdict for all the selected scans.