You can now create an incident to investigate the impact of the incident without deleting emails or any remediation action.

You can review how many emails will be deleted and how your end users interacted with these emails. Once you have reviewed and have completed the investigation, you can click on the button “Delete emails” to delete the emails impacted.

Please note that this will not add sender policies in Email Gateway Defense or block traffic on Barracuda Content Shield. However, you can enable Continuous Remediation after deleting emails.