RSA DLP Quarantined Email
Please can you help is there a way to reprocess blocked Quarantined email..
I have changed the policy I have 2000 email that need to be released, and I cannot sit here doing one by one..
Any alternative method your could help me with.
If an email violates a policy with a quarantine action defined, a warning dialog box appears within the incident details page. Use the
icons or links to select the action you want to take for this email.
An Interceptor allows customers to inspect a transmission, if the transmission is in violation of a policy with the policy action “Quarantine.” The Network Interceptor prevents the e-mail from leaving the company, quarantines the e-mail, generates an incident, and notifies the compliance officer. When you view the Incident List, the quarantined e-mails are listed with Quarantine status.
You can configure the system to permit self-release by the sender of an e-mail. Use this feature when you want to permit company employees to acknowledge that they approve the content of the email. The employees can either release it or discard it and add a justification in a comment area. Once self-release has been globally enabled, it can be disabled on a per-policy basis.
When a transmission is quarantined as a result of being in violation of a policy, and if self-release has been enabled, the sender is sent an e-mail message notifying them of the quarantine and providing a link to a page where they can either release or discard the quarantined e-mail.
There is no automated way to release the quarantined emails from the Enterprise-Manager GUI other than the above mentioned ways.
However, if their size is overwhelming the interceptor(s) queue you can remove all the quarantined emails at once by accessing the interceptor via an SSH session while logging as "tablus" account and doing below:
rm * [to delete all the buffered/quarantined emails].
RSA DLP Tech-Support