Restore requests and how Check Point handles them

When a user asks to release a quarantined email, Check Point does not simply take their word for it. It re-evaluates the message, reaches its own verdict, and then handles the request according to rules you set. This guide explains that flow and the automation levels you can choose.

How a restore request is handled

When a user requests a restore, Check Point re-evaluates the email and gives it a re-evaluated verdict of Clean, Phishing or Inconclusive. What happens next depends on the automation level you have set. Configure it at Security Settings → User Interaction → Quarantine, under Reviewing Restore Requests. Requests that are waiting on an admin appear under User Interaction → Restore Requests.

Automation levels

Each level decides what Check Point does for each re-evaluated verdict:

There is also Incident Response as a Service (IRaaS), an add-on where Check Point analysts handle restore requests and phishing reports for you.

Notifications

For each workflow you can choose who is told:

• Notify Admin: the admin is emailed when a request is sent for review.
• Notify User: the user is emailed when their request is sent for review, approved, or declined.

The options available depend on the workflow you pick.

Related

The end user quarantine digest