Constant Edge

When IRONSCALES quarantines an email, releasing it is a two-step process. You need to mark the incident as Safe to release the email, then stop the remediation to prevent similar emails being caught in the future.

Step 1 — Find the Incident

1. Click Incidents in the top navigation
2. Select Unclassified Incidents or Classified Incidents from the left sidebar
3. Search for the email by sender, subject, or mailbox

Step 2 — Release the Email

1. Open the incident to view the details
2. Click Safe (top right of the incident page),  this reverts the emails back to the recipients’ mailboxes

If you only need to release specific emails from the incident, scroll down to the Emails section, click Manage and review emails, select the ones you want, click Reclassify, and classify them as Safe.

Step 3 — Stop Remediation

Marking as Safe releases the current emails, but it doesn’t stop IRONSCALES from clustering similar future emails into the same incident. To prevent that:

1. Scroll down to the Emails section and click All Emails
2. Click Manage and review emails (bottom right)
3. Click Stop Remediation (top right)
4. A confirmation popup will appear saying: "This will prevent other similar emails to be grouped in this incident and remediate them. Are you sure you want to proceed?" Click Continue to confirm

Once stopped, IRONSCALES won’t add new emails to this incident. If a similar email arrives in the future, a new incident will be created instead.

Important: Stop Remediation cannot be undone.