This article explains when ATP Real-Time Alerts and AutoRemediate Alerts are sent.
Real-Time Alerts and AutoRemediate Alerts are notification features of Advanced Threat Protection. The notifications are sent to the recipients configured in Advanced Threat Protection.
Prerequisites
Make sure the following prerequisites are met:
- Advanced Threat Protection is enabled for the customer.
- Real-Time Alert is enabled for sending ATP Real-Time Alerts.
- AutoRemediate Alerts are enabled.
Real-Time Alert
A Real-Time Alert is sent when Advanced Threat Protection detects an attack and intercepts an email.
Real-Time Alerts are sent in the following cases:
- The Sandbox Engine has found malware.
- Secure Links has blocked a website or a download.
- URL Scanning has found a malicious URL.
- The Targeted Fraud Forensics Filter has filtered emails.
The notification contains information about the type and target of the attack, the sender, and the reason why the email was intercepted.
Note: Real-Time Alerts are only available in English.
AutoRemediate Alert
An AutoRemediate Alert is sent when emails that have already been delivered are later classified as malicious.
If AutoRemediate is enabled for the customer, dangerous emails are deleted from Microsoft 365 mailboxes. Dangerous emails in other mailboxes are marked as Threat.
Recipients of the Notifications
The recipients of the notifications can be added or removed in the Control Panel under Email Security > Advanced Threat Protection.
Once Advanced Threat Protection is enabled, AutoRemediate Alert is activated for all mailboxes of the customer.