ADadaptivesecurity
Email Security

Remediate a security event

Changed on

Move every recipient's copy of a security event's message to trash, spam, or quarantine. The event must be awaiting review, its source connected, and remediation enabled for the company. Remediation runs asynchronously: the response reports REMEDIATING, and the event reaches RESOLVED once every recipient has been remediated.

Required permission: email_security:write

post/v2/email-security/security-events/{eventId}/remediate

Request

  • Base URL
    https://api.adaptivesecurity.com
  • URL
    https://api.adaptivesecurity.com/v2/email-security/security-events/{eventId}/remediate
  • Auth
    HTTP bearer

Path parameters

eventIdstring uuid required

Security event ID

Request body

action'DELETE' | 'MARK_AS_SAFE' | 'MARK_AS_SPAM' | 'MOVE_TO_SPAM' | 'QUARANTINE' nullable required

Where to move every recipient's copy of the message, or how to mark the event. MARK_AS_SAFE and MARK_AS_SPAM relabel the event without moving any message

remediate_future_similar_messagesboolean

Arm this message's campaign so similar messages arriving later are remediated automatically with the same action. The event must belong to a campaign. Similar messages already received are remediated only when remediate_similar_messages is set. Only DELETE, MOVE_TO_SPAM and QUARANTINE accept it

remediate_similar_messagesboolean

Apply the same action to every similar message already in this message's campaign. Messages that arrive later are not affected. A campaign can include a message that was itself judged safe, which this remediates along with the rest and which similar_security_event_ids on the security event does not list. Only DELETE, MOVE_TO_SPAM and QUARANTINE accept it

Example request

{
  "action": "QUARANTINE",
  "remediate_future_similar_messages": true,
  "remediate_similar_messages": true
}

Response

Remediation started

action'DELETE' | 'MARK_AS_SAFE' | 'MARK_AS_SPAM' | 'MOVE_TO_SPAM' | 'QUARANTINE'

The remediation that was started

future_similar_messages_armedboolean

Whether the campaign was armed to remediate similar messages arriving later. False unless remediate_future_similar_messages was requested

idstring uuid

The remediated security event

remediated_similar_security_event_idsstring[]

The similar messages' security events the action was also started for, excluding this one. Empty unless remediate_similar_messages was requested

status'NEEDS_REVIEW' | 'REMEDIATING' | 'RESOLVED'

Review state after the request. Remediation runs asynchronously; poll the security event until it is RESOLVED

Example response

{
  "action": "QUARANTINE",
  "future_similar_messages_armed": true,
  "id": "a8f2947c-3aef-4f5a-981f-08be76fde32f",
  "remediated_similar_security_event_ids": [
    "3f2a8c41-5b6d-4e8f-9a0b-1c2d3e4f5a6b"
  ],
  "status": "REMEDIATING"
}

Changes