Performing Remedial Actions on Messages in Cisco XDR

Before you begin

In Cisco XDR, you can now investigate and apply the following remedial actions on messages processed by your Secure Email and Web Manager:

Make sure you have met the following prerequisites before you perform remedial actions on messages in Cisco XDR:

Enabled and registered your Secure Email and Web Manager with the Cisco XDR server. For more information, see Enable the Cisco XDR Integration on your Secure Email and Web Manager and Register Cisco XDR on Your Secure Email and Web Manager.
Added your Secure Email and Web Manager module to Cisco XDR and specified the Remediation Forwarding Address in Cisco XDR. For more information, go to https://xdr.us.security.cisco.com/administration/integrations navigate to the required Secure Email and Web Manager module to integrate with Cisco XDR, click Get Started, and see the instructions on the page.
Enabled and configured the remediation profiles in the System Administration > Account Settings page in your email gateway. For more information, see the Remediating Messages in Mailboxes chapter of the Cisco Secure Email Gateway User Guide.

Step 1	Log in to Cisco XDR with your user credentials.
Step 2	Perform an investigation for threat analysis by entering required IOCs (for example, URLs, Email Message ID and so on) in the Investigate panel and click Investigate. For more information, see the Investigate topic in the Help section at https://docs.xdr.security.cisco.com/Content/Investigate/investigate.htm.
Step 3	Click the pivot menu button next to the Cisco Message ID or Email Message ID and select the required remedial action (for example, ‘Forward’). For more information, see the Pivot Menu topic in the Help section at https://visibility.amp.cisco.com/help/investigate.