{"id":4058,"date":"2026-06-08T18:02:14","date_gmt":"2026-06-08T15:02:14","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4058"},"modified":"2026-06-08T18:02:14","modified_gmt":"2026-06-08T15:02:14","slug":"why-is-no-action-taken-by-elements-collaboration-protection-to-quarantine-a-high-severity-email-detection","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/why-is-no-action-taken-by-elements-collaboration-protection-to-quarantine-a-high-severity-email-detection\/","title":{"rendered":"Why is no action taken by Elements Collaboration Protection to quarantine a high severity email detection?"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>Why does not Elements Collaboration Protection automatically quarantine a high severity email detection, but an email with a medium severity detection is quarantined?<\/p>\n<h3>Resolution:<\/h3>\n<p>The Elements Collaboration Protection Severity level indicates whether an administrator action is needed to mitigate the immediate risk.<\/p>\n<ul>\n<li><strong>Low:<\/strong> No action is needed because the item is coming from a trusted source.<\/li>\n<li><strong>Medium:<\/strong> No action is needed. The item was automatically either quarantined or deleted.<\/li>\n<li><strong>High:<\/strong> Action required. No automatic action is specified in the policy.<\/li>\n<li><strong>Critical:<\/strong> Immediate action is required to mitigate the risk.<\/li>\n<\/ul>\n<p>If some emails are quarantined and not others, it can be that in the policy you have set only specific content (URLs or files) to trigger a quarantine action.<\/p>\n<p>In case of URLs, they are divided into <strong>harmful<\/strong> and <strong>suspicious<\/strong> in the policy. Both can be given differend actions.\u00a0<\/p>\n<p>How to check the action for both malicious and suspicious URLs:<\/p>\n<ol>\n<li>Log in to the Elements portal<\/li>\n<li>Open the\u00a0<strong>Collaboration Protection\u00a0<\/strong>section from the menu on the left<\/li>\n<li>Go to the Policies page<\/li>\n<li>Open the policy that is in use on your\u00a0cloud service<\/li>\n<li>Open the\u00a0<strong>Exchange\u00a0<\/strong>tab and go to the\u00a0<strong>URL scanning\u00a0<\/strong>page<\/li>\n<\/ol>\n<p>Here in the\u00a0<strong>Action\u00a0<\/strong>section you can make sure that both\u00a0<strong>Malicious URL\u00a0<\/strong>and\u00a0<strong>Suspicious URL\u00a0<\/strong>are set to\u00a0<strong>Move the item to quarantine<\/strong>. Take no action would result in the admin having to manually delete or take action on the item (resulting in a high severity classification).<\/p>\n<p>If the email with high severity classification includes a malicious file, make sure that the malware scanning action has been set up to quarantine the file:<\/p>\n<ol>\n<li>Open the policy that is in use on the cloud service<\/li>\n<li>Open the\u00a0<strong>Exchange\u00a0<\/strong>tab and go to the\u00a0<strong>Malware scanning\u00a0<\/strong>page<\/li>\n<li>In the\u00a0<strong>Action\u00a0<\/strong>section, make sure that the action is set to\u00a0<strong>Move whole item into quarantine<\/strong><\/li>\n<\/ol>\n<p>\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Why does not Elements Collaboration Protection automatically quarantine a high severity email detection, but an email with a medium severity detection is quarantined?<\/p>\n","protected":false},"template":"","support_article_product":[101],"class_list":["post-4058","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000011935","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 15:02:14","import_hash":"c2717bc83b7cbc5d3d14d1b8de6ee003d496f5eb","vanilla_article_id":31362,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/31362-why-is-no-action-taken-by-elements-collaboration-protection-to-quarantine-a-high-severity-email-detection","vanilla_kb_id":30,"vanilla_category_id":124,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4058"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}