Thread Emulation block email as a malicious but we need to release it (false positive)?

[Geomix7]

Is there any way to release an email which was blocked by TE?

[TP_Master]

Hi,
Are you using MTA?
Do you use the "Block the e-mail" option in the policy?

If so, then the mail was dropped.

If you also use Threat Extraction it might have been saved in the Threat Extraction quarantine.

If you want to be able to release mails as FP there are ways to do that. For example, by not blocking e-mails but rather tagging them and sending them to quarantine (or just a different, separate folder) on the exchange side.

HTH