Automatically enabled when you configure IRONSCALES permissions in your agent workflow.
What It Does
- Find incidents by release request, end-user report, recipient, sender, subject or date, and read each one’s sender, SPF result, reputation, link and attachment scans, AI verdict and affected mailboxes
- Classify an incident safe to put its mail back in every affected mailbox, or phishing to remove it, and release one user’s copy only
- Read what was removed from each mailbox, and the company’s statistics
- Add, change and remove allow list entries
- Read, add and tag protected mailboxes, and run the directory auto-sync
- Act on account takeover incidents: mark them safe, or sign the user out of Microsoft 365 or disable the account
- Read and run awareness training campaigns, and each user’s training record
- Set who is emailed about incidents, and read and manage the companies under your partner account
Permission Groups
Neo always asks a technician before it disables a company, changes its features, removes a licensed domain, disconnects its email platform or turns protection off for mailboxes, whatever the group’s approval setting. It never turns off a company’s API access, and never edits mailboxes without naming them. On a ticket, the agent works only on the IRONSCALES company mapped to the ticket’s company.