MailThreatZero: quarantine, investigation and response
For technicians and analysts who answer 'where is my email?' and 'did anyone get this?': message tracking and the per-message breakdown, reviewing and releasing quarantined mail safely, how end-user quarantine digests and their links work, training the classifier, campaigns and indicator sweeps, why delivered and located are different numbers, incidents and playbooks, and what post-delivery removal can and cannot do today.
- Level
- Intermediate
- Length
- About 55 minutes
- Contents
- 3 lessons · 1 video · final exam
- Status
- Published · updated 2 Oct 2026
- MailThreatZero
Skills you'll practise
- Find a message in message tracking and explain its verdict to a customer from the per-stage breakdown
- Review a held message safely and release, delete, allow or block it with the right scope
- Explain what a quarantine digest and its release links can and cannot do
- Run an indicator sweep and report delivered and located counts without confusing them
- Choose indicators to block and steps to take on an incident, knowing which actions need a connected tenant and which are beta
Course outline
- 1.MailThreatZero: quarantine, investigation and responseVideo · 2 min
- 2.What happened to this message?Lesson · 17 min
- 3.Quarantine, release and digestsLesson · 18 min
- 4.When something got throughLesson · 20 min
- 5.MailThreatZero: quarantine, investigation and response: knowledge checkKnowledge check · 16 questions
- 6.MailThreatZero: a link that went bad overnightScenario
- 7.Final exam8 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- MailThreatZero: Features
- MailThreatZero: Feature status (generally available, beta testing, requires setup, not available)
- MailThreatZero: Security capabilities, stage by stage
- MailThreatZero: Security and data handling (retention, transport, access, logging)
- MailThreatZero: For MSPs (tenants, roles, delegated access, portfolio health, reporting)
- MailThreatZero: What a customer receives (onboarding week, alerts, console actions)
- MailThreatZero: How it works (mail path, stages, decision, onboarding, Monitor Mode)
- MailThreatZero: Release notes
- MailThreatZero: home page (stages, explainable verdict example, console walkthrough transcript)
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.