topic Thread Emulation block email as a malicious but we need to release it (false positive)? in Firewall and Security Management https://community.checkpoint.com/t5/Firewall-and-Security-Management/Thread-Emulation-block-email-as-a-malicious-but-we-need-to/m-p/58895#M13283 <P>Is there any way to release an email which was blocked by TE?</P> Wed, 24 Jul 2019 11:46:11 GMT Geomix7 2019-07-24T11:46:11Z Thread Emulation block email as a malicious but we need to release it (false positive)? https://community.checkpoint.com/t5/Firewall-and-Security-Management/Thread-Emulation-block-email-as-a-malicious-but-we-need-to/m-p/58895#M13283 <P>Is there any way to release an email which was blocked by TE?</P> Wed, 24 Jul 2019 11:46:11 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Thread-Emulation-block-email-as-a-malicious-but-we-need-to/m-p/58895#M13283 Geomix7 2019-07-24T11:46:11Z Re: Thread Emulation block email as a malicious but we need to release it (false positive)? https://community.checkpoint.com/t5/Firewall-and-Security-Management/Thread-Emulation-block-email-as-a-malicious-but-we-need-to/m-p/59005#M13284 Hi,<BR />Are you using MTA?<BR />Do you use the "Block the e-mail" option in the policy?<BR /><BR />If so, then the mail was dropped.<BR /><BR />If you also use Threat Extraction it might have been saved in the Threat Extraction quarantine.<BR /><BR />If you want to be able to release mails as FP there are ways to do that. For example, by not blocking e-mails but rather tagging them and sending them to quarantine (or just a different, separate folder) on the exchange side.<BR /><BR />HTH Fri, 26 Jul 2019 05:07:27 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Thread-Emulation-block-email-as-a-malicious-but-we-need-to/m-p/59005#M13284 TP_Master 2019-07-26T05:07:27Z