Continuous Remediation

Incident Response can remediate an incident by deleting emails involved in the incident from users' inboxes. The Continuous Remediation feature extends the period of remediation. When you activate Continuous Remediation, Incident Response will continue to delete any copies of the email that appear in inboxes for 72 hours after the initial remediation has completed.

With Automatic Remediation

Viewing Continuous Remediation Information

On the Incidents page, you can see whether Continuous Remediation is active and the date when it is set to expire.

The number of emails deleted through Continuous Remediation is displayed under the Actions Taken section.

In the Emails Involved section of the Incidents page, emails that were deleted as part of Continuous Remediation are marked with a special icon. Refer to Reviewing Incidents for a list of icons.

Specifying a Default Setting

You can specify whether you want to enable continuous remediation by default whenever you create an incident. You can choose to disable it on a case-by-case basis.

For details on specifying default settings, refer to  Automatic Remediation Settings.

With Incident Response

Activating Continuous Remediation

To continuously remediate emails:

1. Create a new Incident.
2. On the User Options page:
   1. Select the option to delete emails from users' inboxes.
   2. Select the option to turn on Continuous Remediation for this incident.
3. Complete the process of creating the incident, as described in Creating an Incident.  

You can also view Continuous Remediation information as described in the previous section. 

Specifying a Default Setting

You can specify whether you want to enable continuous remediation by default whenever you create an incident. You can choose to disable it on a case-by-case basis.

For details on specifying default settings, refer to Manual Remediation Settings.