Proofpoint Quarantine

Proofpoint Quarantine Management

Overview

Proofpoint quarantine holds messages that have been identified as threats, spam, or policy violations. The quarantine API allows administrators to search, preview, release, and delete quarantined messages. This is a critical workflow for MSP help desk teams who need to respond to "missing email" requests from end users.

Quarantine operates at two levels:

• Admin quarantine - Managed by administrators, holds threats and policy violations
• End-user quarantine - Self-service spam quarantine with digests

Key Concepts

Quarantine Reasons

| Reason | Description | Default Retention | |--------|-------------|-------------------| | spam | Message scored above spam threshold | 30 days | | phish | Message identified as phishing | 30 days | | malware | Message contained malware | 30 days | | impostor | Message flagged as BEC/impostor | 30 days | | bulk | Bulk/marketing email | 14 days | | adult | Adult content filter match | 30 days | | policy | Custom policy rule match | Configurable | | dmarc | Failed DMARC authentication | 30 days | | dkim | Failed DKIM verification | 30 days | | spf | Failed SPF check | 30 days |

Quarantine Folders

| Folder | Contents | Release Allowed | |--------|----------|-----------------| | quarantine | Admin quarantine (threats, policy) | Admin only | | spam | End-user spam quarantine | End-user or admin | | bulk | Bulk/graymail quarantine | End-user or admin |

Message States

| State | Description | |-------|-------------| | quarantined | Message is held in quarantine | | released | Message was released to recipient | | deleted | Message was permanently deleted | | expired | Message exceeded retention period and was removed |

Field Reference

Quarantine Message Fields

| Field | Type | Description | |-------|------|-------------| | id | string | Unique quarantine message identifier | | GUID | string | Message GUID (links to TAP events) | | QID | string | Queue ID from mail server | | sender | string | Envelope sender address | | recipients | string[] | List of recipient addresses | | subject | string | Message subject line | | date | datetime | When the message was received | | quarantineDate | datetime | When the message was quarantined | | reason | string | Why the message was quarantined | | folder | string | Which quarantine folder holds the message | | size | int | Message size in bytes | | headerFrom | string | Display From address (may differ from envelope sender) | | replyTo | string | Reply-To address if present | | spamScore | int | Spam confidence score | | phishScore | int | Phishing confidence score | | malwareScore | int | Malware confidence score | | impostorScore | int | Impostor/BEC confidence score |

Search Parameters

| Parameter | Type | Description | |-----------|------|-------------| | sender | string | Filter by sender address (exact or partial) | | recipient | string | Filter by recipient address | | subject | string | Filter by subject (substring match) | | startDate | datetime | Start of date range | | endDate | datetime | End of date range | | reason | string | Filter by quarantine reason | | folder | string | Filter by quarantine folder | | limit | int | Maximum results (default 25, max 500) | | offset | int | Pagination offset |

MCP Tools

| Tool | Description | Key Parameters | |------|-------------|----------------| | proofpoint_quarantine_search | Search quarantined messages | sender, recipient, subject, reason, startDate, endDate | | proofpoint_quarantine_list | List recent quarantined messages | folder, limit, offset | | proofpoint_quarantine_get | Get details of a specific quarantined message | id | | proofpoint_quarantine_preview | Preview message content without releasing | id | | proofpoint_quarantine_release | Release message to original recipient | id, recipient | | proofpoint_quarantine_delete | Permanently delete quarantined message | id | | proofpoint_quarantine_bulk_release | Release multiple messages at once | ids[] | | proofpoint_quarantine_bulk_delete | Delete multiple messages at once | ids[] |

Common Workflows

User Reports Missing Email

1. Get the sender and approximate time from the user
2. Call proofpoint_quarantine_search with recipient=<user> and sender=<expected_sender> and appropriate date range
3. If found, call proofpoint_quarantine_preview to verify the message is legitimate
4. If legitimate, call proofpoint_quarantine_release to deliver the message
5. If the sender is consistently quarantined, consider adding a safe sender policy

Daily Quarantine Review

1. Call proofpoint_quarantine_list with folder=quarantine and limit=100
2. Review messages grouped by reason
3. Release any false positives
4. Delete confirmed threats
5. Note recurring senders for blocklist consideration

Bulk Release for Known-Good Sender

1. Call proofpoint_quarantine_search with sender=<known_good_sender>
2. Collect all message IDs from results
3. Call proofpoint_quarantine_bulk_release with the collected IDs
4. Recommend adding the sender to the organization's safe sender list

Investigate Quarantine Spike

1. Call proofpoint_quarantine_search with a narrow time window
2. Group results by reason to identify what type of messages increased
3. Group by sender to identify if a single source is responsible
4. Cross-reference with TAP data using message GUIDs
5. Determine if this is a targeted attack or spam campaign

Clean Up Expired Threats

1. Call proofpoint_quarantine_search with reason=malware and date range > 14 days
2. Review any remaining malware-quarantined messages
3. Call proofpoint_quarantine_bulk_delete to remove confirmed threats
4. Document any messages that were released for audit trail

Error Handling

Common API Errors

| Code | Message | Resolution | |------|---------|------------| | 400 | Invalid date range | Ensure startDate is before endDate | | 400 | Invalid folder | Use quarantine, spam, or bulk | | 401 | Authentication failed | Verify service principal and secret | | 403 | Insufficient permissions | Ensure quarantine management is enabled | | 404 | Message not found | Message may have expired or been deleted | | 409 | Message already released | Message was already released by another admin | | 429 | Rate limit exceeded | Implement backoff; limit bulk operations |

Release Failures

If a release fails:

• The message may have been deleted or expired
• The recipient mailbox may be full or invalid
• The downstream mail server may be rejecting delivery
• Check the message ID is correct and the message still exists in quarantine

Search Returning Too Many Results

• Narrow the date range
• Add more specific filters (sender + recipient + subject)
• Use pagination with limit and offset
• Filter by specific quarantine reason

Best Practices

1. Preview before release - Always preview a message before releasing to verify it is legitimate
2. Document releases - Keep a log of released messages for audit purposes
3. Use bulk operations carefully - Bulk release should only be used for verified false positives
4. Monitor quarantine volume - Spikes may indicate a targeted attack or misconfigured policy
5. Set up digests - Enable end-user quarantine digests to reduce help desk load
6. Review retention policies - Ensure quarantine retention matches your compliance requirements
7. Never release confirmed threats - If a message is confirmed malware or phishing, delete it
8. Cross-reference with TAP - Use the GUID to check TAP threat data before releasing
9. Safe sender lists - For recurring false positives, add the sender to the safe sender list rather than releasing each time
10. Train users - Educate users on checking their quarantine digest before