Issue:
How to report a false positive or negative for Elements Collaboration Protection?
- Harmless website / link / webpage / attachment file blocked and email has been quarantined (false positive)
- Harmful website / link / webpage / attachment file has been allowed through (false negative)
Resolution:
If you suspect the detection to be a false positive or negative, submit the file or URL sample to our labs to have the detection corrected. How to proceed for the submissions is documented in our Help Guide page with the link to our labs page: Submitting a sample
It usually takes our labs 24-48h to have the file or URL analyzed and have the detection corrected.
The URL can also be reported directly from the Elements Collaboration Protection portal's Security alerts page.
If the email is urgent and the cause for the quarantine is a possibly malicious URL, you can add the URL to Trusted websites by using these steps:
- Log in to the Elements Collaboration Protection portal
- Go to the Policies page
- Select a profile you want to edit
- Select the Exchange online > URL scanning
- Scroll down to the Trusted websites section and enable it
- Enter the domain address in the Websites field
- Click Save
Article no: 000025568