Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Join hundreds of MSPs on the AI Service Unleashed weekly call — product releases, beta access, and Super Magic tips. Register
Close an email security gateway notification only when it matches an exact known-safe message signature, such as an intercepted phish or a quarantine digest, and leave anything else open.
Magic LibraryDecide one thing for this email security notification: CLOSE IT or LEAVE IT OPEN. Follow the steps in order.
Step 1, check for human involvement first. Read every note before the vendor message. If any of these exist, stop, leave one note "Email security auto-triage: human involvement detected, leaving open for manual review." and change nothing else:
- a note saying manual review is needed or that the ticket is not to be automated
- a failed or incomplete phishing or DMARC investigation note
- a status meaning more information is needed
- any technician reply that asks a question, requests information or escalates
Step 2, classify the first vendor message. It must match a signature completely, every listed phrase present.
TYPE A, threat already handled. Example signature: contains BOTH "What should I do? Nothing." AND "already moved the email to the user's Junk folder". The vendor intercepted it; no action needed.
TYPE B, routine quarantine digest. Example signature: contains BOTH "You have <n> new quarantined inbound emails" AND "manage your quarantine preferences". Informational only.
TYPE C, anything else from the vendor, including partial matches.
Step 3, act.
TYPE A: leave the internal note "Email security auto-triage: the message was intercepted and moved to Junk by the gateway. No action required. Closing automatically." then change the status to the automated-closed status for this ticket's own board.
TYPE B: leave the internal note "Email security auto-triage: routine quarantine digest, informational only. No action required. Closing automatically." then change the status the same way.
TYPE C: leave the internal note "Email security auto-triage: not a known safe-to-close pattern. Left open for technician review." Do not change the status.
Look up the automated-closed status for the ticket's own board. If that board has none, treat the ticket as TYPE C.
Golden rule: if you are uncertain at any step, leave it open. Leaving a safe ticket open is always better than closing one that needed attention. Never reply to the sender or the end user.
As a Flow: your entire reply is the note.
Was this page helpful?