Time to Contain

Message purge

Message purge removes a delivered phishing message from user mailboxes, from one mailbox or from many, by message ID, sender or search. It stops further clicks. It is the main email containment action, with quarantine as a reversible alternative that keeps the message for review.

Definition

A purge by sender can hit legitimate mail if the match is wide. Search scope is the blast radius here, so check whether the platform previews matches.

The scorecard counts delete and quarantine of a delivered message as two actions, because quarantine can be reversed and delete cannot.

Message purge in Cyware's documentation

Cyware's Orchestrate page lists 150-plus playbook templates, including phishing response, which is where a message purge step would sit, though the page does not list purge as an action. vendor claim cyware.com, read

The example names a vendor and its own page. A vendor's use of Message purge may differ from the definition above; the rubric uses the definition on this page.