Review & Release Quarantine

Quarantined emails — whether user-reported or caught by auto-triage — land in the Quarantine queue for review. This guide covers the analyst workflow.

What quarantine does

When a message is quarantined, Helios physically moves it out of the user’s inbox (to the HELIOS_QUARANTINE label in Gmail, or the equivalent folder in Microsoft 365) and records a FLAGGED_AS relationship for the sender.

Review workflow

1. Open Quarantine in the sidebar. Each row shows the sender, subject, verdict, and risk score.

2. Click a message to open the detail drawer: the AI verdict rationale, sender reputation, link/attachment analysis, and sandbox detonation results.

3. Decide:

   • Confirm — the email is malicious; leave it quarantined.
   • Release (false positive) — return it to the user’s inbox.

Releasing a false positive

Releasing does more than move the email back:

• The message is reinjected to the original recipient’s inbox.
• The sender’s FLAGGED_AS edge is retracted and their reputation score is recomputed — so Helios learns from the correction.

Tip

Because reputation is self-correcting, consistently releasing a trusted sender’s mail quickly stops it from being re-flagged.

Verdict reference

Verdict	Meaning
QUARANTINE	Malicious — moved out of the inbox
DISMISS	Clean — reinjected if it was user-reported
ESCALATE	Needs human review
MARK_AS_SPAM	Moved to the spam/junk folder

See How Auto-Triage Works for how these verdicts are produced.