Anyone know if there's a way to determine as a matter of fact if a customer releases an email from quarantine.
That's what happens here, but there's no way to know that.
You should see it in the audit log. https://central.sophos.com/manage/logs_and_reports/protection/audit
Keep in mind, the search is only applicable to Users and IP. So you cannot search for Release.
You could export it (CSV) and search in Excel.
__________________________________________________________________________________________________________________
Yep, that's brilliant, shows exactly what I'm after, thanks.
Ideally it needs info like email ID, or sender & receiver.
Incidentally, I always forget that these two report buttons go to different places and show different reports. Would be good to merge them in to one.
Tom Foucha FYI
The purpose of the two Reports is every product in Central has it's own reports developed by the product teams and Central itself maintains reports like the Audit Log and Event logs. Duplication does exist as it replicates the links to the various product reports. I find it like you I tend to forget about the top bar Reports link until I need something like the Audit Log.
Although if you add a custom/scheduled report within Email Security, it gets added to the Central report section rather than the Email report section. That has caught me out before, because I've wanted to edit the report but couldn't find it anywhere. It's actually how I found out the link at the top went somewhere different.
Maybe in the Email Report section (above), add a link to "Audit" under "Email Security Logs" or something?