Managing Multiple Events

If more than one Security Event is raised when processing an email message, they are listed as a single collapsed event. You can expand the item to view all of the events reported for the affected email message and perform actions (such as Quarantine) or on all of the events listed in the grouped events.

For example, if malware, DLP, and phishing alerts have all been assigned to the same email message, the email message will only be listed once, but all three of these events will be listed. You can then act on all of the events reported for the email message or only specific ones.