sophos_search_post_delivery_quarantine
Search messages delivered but later quarantined to enable post-delivery remediation and clawback workflows.
Instructions
Search post-delivery quarantine messages (messages that were delivered but later quarantined). Use this for clawback/post-delivery remediation workflows.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number (1-based) | |
| sort | No | Sort fields, e.g. ['forRecipient:DESC'] | |
| end_date | No | End date ISO 8601 | |
| page_size | No | Results per page | |
| tenant_id | Yes | Tenant UUID | |
| begin_date | No | Start date ISO 8601 | |
| filter_reason | No | Filter by reason (e.g. ['malware','phishing']) | |
| filter_to_contains | No | Filter: recipient address contains | |
| filter_from_contains | No | Filter: sender address contains | |
| filter_has_attachment | No | Filter messages with attachments | |
| filter_subject_contains | No | Filter: subject contains |