Quarantine Reports

The Quarantine Reports feature allows administrators to schedule, customize, and manage summary reports that are sent to administrators and/or users via email. These reports provide an overview of content quarantined in MetaDefender for Microsoft 365.

Report List

Admins can view and manage existing reports from the Reports section under Settings.

Search bar: Allows users to filter reports by report name or subject
Report columns:
- Report name: The internal name assigned to the report.
- Subject: The subject line used in the sent email.
- Status: Toggle to activate or deactivate scheduled sending.
Report buttons:
- Delete: Delete icon to permanently remove the report.
- Clone: Clone the report.

Creating a New Report

Click Add new report in the top-right corner.

Choose Report Type

Select report type from the drop down list:

Administrator Quarantine Report – Similar to User Quarantine Reports but includes all quarantined content for all users:
- Direct link to the Quarantine portal
- Summary count
User Quarantine Report – Notifies end users about content quarantined for them
- Setails: Sender, subject, date, verdict
- Optional action links for:
  - Releasing content
  - Rescan content

For other report types, see Scan Reports.

Report Settings

Each report includes the following configuration options:

Active – Enables or disables the report.
Report name – Internal descriptive name.
Report subject – Subject line of the email.
Email sender – From address for outgoing reports.
Select days of the week – Choose which days the report is sent.
Use custom start date - Choose a custom start date for the first report. If not selected, content quarantined from the report creation date will be included in the first report.
Time / Time zone – Schedule delivery time.
Recipients – Select users or groups to receive the report.
Allowed actions – Allow users to Deliver, Rescan content and/or View scan results.
Verdicts filter – Restrict report to specific verdicts (e.g. Malicious, Suspicious, Encrypted content).

Editing a Report

Clicking on a report opens the Report Details page, where you can configure general settings and the email content.

Report Settings

Report Name: Internal display name for the report.
Report subject: Subject line used in the report email.
Email Sender: Specifies the sender email address, for example: noreply@mycompany.com.
- The sender field can also include both display name and email address as follows: "Display name" <noreply@mycompany.com>.
Schedule: Choose the days of the week and time for delivery.
Time zone: Define the time zone for scheduled delivery.
Recipients: Users or groups to receive the report.

Email Content Customization

HTML Tab:
- Provides a rich text editor for formatting email content.
- Users can insert fields, format text, add tables, and customize the layout.
Plain Text Tab:
- Used for text-based email clients.

Info

When editing HTML content, the plain text version is automatically updated, based on the content provided.

Email Content Preview

Shows a sample report email with placeholders replaced by actual data.

Scripting Language

It is also possible to additionally customize report templates using the Handlebars template scripting language. For more information see: https://handlebarsjs.com/guide/

Custom Fields

The following field can be inserted into email report templates:

Administrator Quarantine Report

Category	Name	Description
Report	Date/Time Created	When the report was generated. Apply a formatting helper to control how the date and time appear.
Items	Quarantined	Group heading. The items currently held in quarantine.
Items → Quarantined	Count	How many items are in quarantine and awaiting an administrator's decision.
Actions	URL	The link the recipient follows to review the quarantined items.

User Quarantine Report

Category	Name	Description
Report	Date/Time Created	When the report was generated. Apply a formatting helper to control how the date and time appear.
Quarantined	Count	How many items are being held for this user.
Quarantined	Items	Group heading. The quarantined items themselves, as a list — loop over it to show each one. Every field below belongs to a single item within that loop.
Quarantined → Items	Type	The kind of item: `email`, `message` (Teams) or `file`.
Quarantined → Items	Date/Time Sent	When the item was sent or last changed — the date sent for email, the message timestamp for Teams, the date last modified for files. Apply a formatting helper.
Quarantined → Items	Size	Size of the item. Apply a formatting helper to show it in KB or MB.
Quarantined → Items	Message ID	Unique identifier of the message: the `Message-ID` header for email, or the Teams message ID. Not available for files.
Quarantined → Items	Thread URL	A direct link to the item — the email in the quarantine portal, the message in Teams, or the file in SharePoint or OneDrive.
Quarantined → Items	Verdict	The overall verdict for the item, combining the results of every engine that scanned it.
Quarantined → Items	Sender	Group heading. Select one of the sender fields below.
Quarantined → Items → Sender	Name	Display name of the sender.
Quarantined → Items → Sender	Address	Address of the sender: the SMTP address for email, the user principal name for Teams, or the file owner for SharePoint and OneDrive.
Quarantined → Items → Sender	Sender Email Address	SMTP envelope sender address. This can differ from the visible From address. Email only.
Quarantined → Items	To:	Group heading. Recipients on the To: line, as a list — loop over it to show every recipient. Email only.
Quarantined → Items → To:	Name	Display name of a To: recipient.
Quarantined → Items → To:	Email Address	Email address of a To: recipient.
Quarantined → Items	Cc:	Group heading. Recipients on the Cc: line, as a list — loop over it to show every recipient. Email only.
Quarantined → Items → Cc:	Name	Display name of a Cc: recipient.
Quarantined → Items → Cc:	Email Address	Email address of a Cc: recipient.
Quarantined → Items	Subject	The email subject line, or the subject of a Teams channel post. Teams chat messages have no subject.
Quarantined → Items	Attachments	Group heading. Files carried by the item, as a list — loop over it to show every attachment. Covers email attachments and files shared in Teams.
Quarantined → Items → Attachments	Name	Filename of an attachment or shared file.
Quarantined → Items	Channel	Group heading. Details of the Teams conversation the message was posted in. Teams only.
Quarantined → Items → Channel	Name	Name of the conversation: the topic of a named group chat, or `<team> / <channel>` for a channel post. Empty for one-to-one chats and unnamed group chats.
Quarantined → Items → Channel	Type	Whether the message was posted in a `Channel` or a `Chat`.
Quarantined → Items → Scan	Engines	Group heading. Information about the engines that scanned the item.
Quarantined → Items → Scan → Engines	Count	How many engines scanned the item.
Quarantined → Items → Scan → Engines	Triggered	Group heading. The engines that returned the item's verdict.
Quarantined → Items → Scan → Engines → Triggered	Count	How many engines returned the item's verdict.
Quarantined → Items → Scan → Engines → Triggered	Engines	The engines that returned the verdict, as a list — loop over it to name each one.
Quarantined → Items → Scan → Engines → Triggered → Engine	Name	Name of a triggered engine.
Quarantined → Items → Scan	Verdict	Group heading. The verdict reached for the item.
Quarantined → Items → Scan → Verdict	Name	Verdict name, for example Malicious or Suspicious.
Quarantined → Items → Scan → Verdict	Description	A short explanation of what the verdict means.
Quarantined → Items → Scan	Threat	Group heading. Details of the threat found, when one was found.
Quarantined → Items → Scan → Threat	Name	Name of the threat detected.
Quarantined → Items → Scan → Threat	Description	A plain-language explanation of the threat and why it is a risk.
Quarantined → Items → Scan → Threat	Severity	How serious the threat is, on a scale of 1 to 10.
Quarantined → Items → Scan	Affected Files	Group heading. The files that caused the item to be quarantined, as a list — loop over it to show each one.
Quarantined → Items → Scan → Affected Files	Name	Name of the affected file.
Quarantined → Items → Scan → Affected Files	Type	The true file type, as identified during scanning. This can differ from the file extension.
Quarantined → Items → Scan → Affected Files	Verdict	The verdict for this individual file.
Quarantined → Items	Policy	Group heading. The policy that was applied to the item.
Quarantined → Items → Policy	Name	Name of the policy that was applied.
Quarantined → Items → Policy	Action	What the policy did: `Blocked` or `Allowed`.
Actions	URL	The link the user follows to review their quarantined items and request a release.

Last updated on

Was this page helpful?