Email containment actions
5 actions in the scorecard's Email domain: which of eighteen platforms document each against a named target, and the vendor page that shows it. Read 2026-11-03 and 2026-11-04.
5actions
The grid for this domain
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | |||||
|---|---|---|---|---|---|
| Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | |
| Tines4 of 5 documented | Tines: Quarantine a delivered message, not documented | ||||
| Cyware3 of 5 documented | Cyware: Quarantine a delivered message, not documented | Cyware: Remove a URL rewrite exemption, not documented | |||
| D3 Security3 of 5 documented | D3 Security: Quarantine a delivered message, not documented | D3 Security: Remove a URL rewrite exemption, not documented | |||
| Google Security Operations3 of 5 documented | Google Security Operations: Quarantine a delivered message, not documented | Google Security Operations: Remove a URL rewrite exemption, not documented | |||
| Palo Alto Cortex XSOAR3 of 5 documented | Palo Alto Cortex XSOAR: Quarantine a delivered message, not documented | Palo Alto Cortex XSOAR: Remove a URL rewrite exemption, not documented | |||
| Splunk SOAR (Cisco)3 of 5 documented | Splunk SOAR (Cisco): Quarantine a delivered message, not documented | Splunk SOAR (Cisco): Pull from quarantine, not documented | |||
| BlinkOps2 of 5 documented, not ranked | BlinkOps: Quarantine a delivered message, not documented | BlinkOps: Remove a URL rewrite exemption, not documented | |||
| Swimlane2 of 5 documented | Swimlane: Quarantine a delivered message, not documented | Swimlane: Remove a URL rewrite exemption, not documented | Swimlane: Pull from quarantine, not documented | ||
| Exabeam1 of 5 documented, not ranked | Exabeam: Quarantine a delivered message, not documented | Exabeam: Block sender or domain, not documented | Exabeam: Remove a URL rewrite exemption, not documented | Exabeam: Pull from quarantine, not documented | |
| Microsoft Sentinel1 of 5 documented | Microsoft Sentinel: Quarantine a delivered message, not documented | Microsoft Sentinel: Block sender or domain, not documented | Microsoft Sentinel: Remove a URL rewrite exemption, not documented | Microsoft Sentinel: Pull from quarantine, not documented | |
| Torq1 of 5 documented | Torq: Quarantine a delivered message, not documented | Torq: Block sender or domain, not documented | Torq: Remove a URL rewrite exemption, not documented | Torq: Pull from quarantine, not documented | |
| CrowdStrike Falcon Fusion SOAR0 of 5 documented, docs behind login | CrowdStrike Falcon Fusion SOAR: Delete a delivered message, not documented | CrowdStrike Falcon Fusion SOAR: Quarantine a delivered message, not documented | CrowdStrike Falcon Fusion SOAR: Block sender or domain, not documented | CrowdStrike Falcon Fusion SOAR: Remove a URL rewrite exemption, not documented | CrowdStrike Falcon Fusion SOAR: Pull from quarantine, not documented |
| Dropzone AI0 of 5 documented | Dropzone AI: Delete a delivered message, not documented | Dropzone AI: Quarantine a delivered message, not documented | Dropzone AI: Block sender or domain, not documented | Dropzone AI: Remove a URL rewrite exemption, not documented | Dropzone AI: Pull from quarantine, not documented |
| Mate Security0 of 5 documented | Mate Security: Delete a delivered message, not documented | Mate Security: Quarantine a delivered message, not documented | Mate Security: Block sender or domain, not documented | Mate Security: Remove a URL rewrite exemption, not documented | Mate Security: Pull from quarantine, not documented |
| Prophet Security0 of 5 documented | Prophet Security: Delete a delivered message, not documented | Prophet Security: Quarantine a delivered message, not documented | Prophet Security: Block sender or domain, not documented | Prophet Security: Remove a URL rewrite exemption, not documented | Prophet Security: Pull from quarantine, not documented |
| Revelstoke (Arctic Wolf)0 of 5 documented, not ranked | Revelstoke (Arctic Wolf): Delete a delivered message, not documented | Revelstoke (Arctic Wolf): Quarantine a delivered message, not documented | Revelstoke (Arctic Wolf): Block sender or domain, not documented | Revelstoke (Arctic Wolf): Remove a URL rewrite exemption, not documented | Revelstoke (Arctic Wolf): Pull from quarantine, not documented |
| ServiceNow Security Operations0 of 5 documented | ServiceNow Security Operations: Delete a delivered message, not documented | ServiceNow Security Operations: Quarantine a delivered message, not documented | ServiceNow Security Operations: Block sender or domain, not documented | ServiceNow Security Operations: Remove a URL rewrite exemption, not documented | ServiceNow Security Operations: Pull from quarantine, not documented |
| ThreatConnect0 of 5 documented, not ranked | ThreatConnect: Delete a delivered message, not documented | ThreatConnect: Quarantine a delivered message, not documented | ThreatConnect: Block sender or domain, not documented | ThreatConnect: Remove a URL rewrite exemption, not documented | ThreatConnect: Pull from quarantine, not documented |
11of 18 document it
Delete a delivered message
Remove a delivered phishing message from user mailboxes, from one mailbox or across many, by message ID, sender or search.
Typical targets: Microsoft Exchange Online, Gmail, Mimecast (remediation incident), Microsoft Defender for Office 365, Microsoft Purview.
- Tines, native: Gmail: Batch delete emails, Delete an email templates; Microsoft Graph: Delete a message template; Mimecast: Create Remediation Incident by MessageID or Hash template. tines.com, read
- Cyware, native: Gmail: Delete Emails with Specific Email ID, Delete Emails with Specific Subject. techdocs.cyware.com, read
- D3 Security, native: Microsoft Exchange Server: Remove Emails; Office 365: Delete Email Message; Gmail V2: Delete Emails; Microsoft Purview eDiscovery V2: Purge Emails (cross-mailbox); Microsoft 365 Defender Email and Collaboration: Delete Search Result Emails. docs.d3security.com, read
- Google Security Operations, native: Exchange: Delete Mail; Microsoft Graph Mail: Delete Email; Gmail: Delete Email. cloud.google.com, read
- Palo Alto Cortex XSOAR, native: Microsoft Graph Mail: msgraph-mail-delete-email (per mailbox); Gmail: gmail-delete-mail with gmail-search-all-mailboxes; Mimecast: mimecast-create-remediation-incident (by message ID or hash). github.com, read
- Splunk SOAR (Cisco), native: Office 365 (Splunk): delete email; Office 365 (MS Graph): delete email. github.com, read
- BlinkOps, native: Microsoft Outlook: Delete Email, Permanently Delete Email; Gmail: Delete Gmail Message; Mimecast: Create Remediation Incident. docs.blinkops.com, read
- Swimlane, native: Microsoft Exchange: Delete from All Mailboxes; Microsoft Graph Mail: Delete Email. docs.swimlane.com, read
- Exabeam, native: Microsoft Exchange service: delete emails; Microsoft Outlook Office 365 service: delete emails. docs.exabeam.com, read
- Microsoft Sentinel, native: Office 365 Outlook (Logic Apps connector): Delete email (V2). learn.microsoft.com, read
- Torq, native: Microsoft 365: Delete Message step. kb.torq.io, read
Not documented on the pages read (7): CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations, ThreatConnect.
0of 18 document it
Quarantine a delivered message
Move an already delivered message into the administrator quarantine, instead of deleting it, so it can be reviewed or restored.
Typical targets: Microsoft Defender for Office 365, Mimecast, Proofpoint, Cisco Secure Email.
No platform of the eighteen documents this action against a named target on the pages read.
Not documented on the pages read (18): Tines, Cyware, D3 Security, Google Security Operations, Palo Alto Cortex XSOAR, Splunk SOAR (Cisco), BlinkOps, Swimlane, Exabeam, Microsoft Sentinel, Torq, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations, ThreatConnect.
7of 18 document it
Block sender or domain
Add a sender address or domain to the gateway blocklist so later mail is rejected or quarantined.
Typical targets: Mimecast, Microsoft Defender for Office 365, Exchange Online, Cisco Secure Email, Proofpoint.
- Tines, native: Mimecast: Create Blocked Senders Policy, Permit or Block Sender templates; Cisco Secure Email: Append Sender Blocklist Entries template. tines.com, read
- Cyware, native: Mimecast: Block Sender. techdocs.cyware.com, read
- D3 Security, native: Microsoft 365 Defender Email and Collaboration: Block Senders; Mimecast: Block Sender; Cisco Email Security: Block Email Addresses. docs.d3security.com, read
- Google Security Operations, native: Microsoft Graph Mail: Block Sender, Block Domain; Mimecast: Block Sender; Exchange: Block Sender by Message ID. cloud.google.com, read
- Palo Alto Cortex XSOAR, native: Mimecast: mimecast-create-block-sender-policy, mimecast-update-block-sender-policy. github.com, read
- Splunk SOAR (Cisco), native: Office 365: block sender; Mimecast: blocklist sender. github.com, read
- Swimlane, native: Mimecast Security: Create Block Sender Policy. docs.swimlane.com, read
Custom step only: BlinkOps. Mimecast: Mimecast Custom Action (generic API call step)
Not documented on the pages read (10): Exabeam, Microsoft Sentinel, Torq, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations, ThreatConnect.
2of 18 document it
Remove a URL rewrite exemption
Delete a URL from the permit or bypass list of the email gateway's URL rewriting and click protection, so it is scanned again.
Typical targets: Mimecast (managed URLs), Proofpoint URL Defense, Microsoft Defender for Office 365 (Safe Links).
- Tines, native: Mimecast: Delete Managed URL template. tines.com, read
- Splunk SOAR (Cisco), native: Mimecast: unallowlist url. github.com, read
Not documented on the pages read (16): Cyware, D3 Security, Google Security Operations, Palo Alto Cortex XSOAR, BlinkOps, Swimlane, Exabeam, Microsoft Sentinel, Torq, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations, ThreatConnect.
6of 18 document it
Pull from quarantine
Release a held or quarantined message back to the recipient after review.
Typical targets: Mimecast, Microsoft Defender for Office 365, Proofpoint Protection Server, Cisco Secure Email.
- Tines, native: Proofpoint Protection Server: Release Quarantined Message template; Cisco Secure Email: Trigger Release from Quarantine template; Mimecast: Hold Release template. tines.com, read
- Cyware, native: Mimecast: Release Held Message. techdocs.cyware.com, read
- D3 Security, native: Microsoft 365 Defender Email and Collaboration: Release Quarantine Messages; Mimecast: Release Message; Proofpoint Protection Server: Release Quarantine Messages. docs.d3security.com, read
- Google Security Operations, native: Mimecast: Release Message. cloud.google.com, read
- Palo Alto Cortex XSOAR, native: Mimecast: mimecast-release-held-message. github.com, read
- BlinkOps, native: Mimecast: Release Message Hold. docs.blinkops.com, read
Not documented on the pages read (12): Splunk SOAR (Cisco), Swimlane, Exabeam, Microsoft Sentinel, Torq, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations, ThreatConnect.