Auto-review

Overview

Auto-review is an Action for highly effective Rules to automate the message review process.

Auto-review marks flagged message groups as “auto-reviewed”, adds a classification (Malicious, Benign, Graymail, Spam, or Simulation), and prevents the flagged message from appearing in your default triage view.

You can view all auto-reviewed messages via Flagged > Auto-Reviewed in the nav.

How to add auto-review to a Rule

Auto-review can't be added to Rules in-bulk. Instead, you need to add auto-review to each Rule so you can see a classification.

1. Select a Rule and open its details page.
2. On the details page, click "Edit" or "Edit metadata" in the top right.
3. Add the Action "Auto-review".
4. After you select "Auto-review", a new field called "Classification for Auto-Review" will appear. Select a classification (Malicious, Unwanted) that best aligns with the classification you usually select during manual reviews of its matching messages.
   For example, if a Rule is very effective at locating spam messages and I want to assign auto-review to it, I will choose the classification "unwanted".
5. Click "Save Rule"

Auto-review hierarchy

Auto-review uses a hierarchy to determine which classification to apply in cases where 2 or more classifications are being applied:

Simulation > Benign > Malicious > Spam > Graymail

This means that if Automation #1 with auto-review as simulation and Automation #2 with auto-review as malicious both match a given message, auto-review will choose to mark the message as simulation instead of malicious.