Give mail administrators and security operators a shared view of filtering health, investigations and the changes they make.
Review traffic behaviour and available service health information from the same interface used for investigations. Configured monitoring helps operators identify changes that need attention and collect relevant evidence for support.
Monitor authenticated senders for unusual behaviour and enforce sending limits per account and tenant. Operators can investigate incidents, restrict or suspend an account, and track remediation before restoring access. Start in observe mode to review the effect of a policy before enforcement.
Use authenticated access and operator roles to control available actions. Where auditing is installed, review recorded changes alongside the investigation context, helping teams understand who acted and why.
Run Console on your infrastructure and choose capture, quarantine and analytics retention to suit your organisation. Plan storage and access around the sensitivity of mail content and the evidence your operators need.
Work with the Rspamd core team on deployment, tuning and difficult filtering cases. Signed offline installation and update bundles support isolated environments; support coverage and the process for sharing evidence can be agreed for your security requirements.
Example workflow
Outbound containment requires an integration at message submission; it cannot recall mail already sent. Monitoring, audit coverage and retention depend on your installation. Agree support coverage, response times and restricted-environment arrangements with the team.