To set default values for Manual Remediation:
- Log into Incident Response.
- From the menu, select Settings.
- On the Settings page, select the Manual Remediation tab.
- Set the following defaults for your organization:
- Delete emails from users' mailboxes – Recommended value: Yes. If you choose not to delete, suspicious or malicious emails remain in users' inboxes. This option must be selected to enable continuous remediation in the next field.
- Enable continuous remediation for incidents – Recommended value: Yes. Enable if you want the system to locate and delete emails matching your search criteria for 72 hours past the original deletion time.
You must enable the Delete emails option to use this option. For more information, see Continuous Remediation.
- Send an email alert to the recipient – Enable if you want to alert the email recipient when they are affected by an incident. Optionally, click Customize Alert to use your own text in email notifications. Save your customized text or revert to the default text.
- Send an email alert to the security team – Enable if you want to alert your organization's security team for each incident. If you enable this option, you must specify the default security team email here. Enter a single email, either to a single recipient or to a distribution list.