Automate remediation for the Cortex Advanced Email Security module
The lightweight, real-time response engine inside the Advanced Email Security module executes automatic policy-driven actions to quickly respond to email threats before they manifest. Build your policy from the rules you configure by customizing the out-of-the-box templates.
Define the rules for your email security policy in Email Remediation Response Rules, located in **Modules** → **Email Security** → **Remediation** → **Rules**.
Review all the remediation actions initiated by your policy in the Email Remediation Action Center, located in **Modules** → **Email Security** → **Remediation** → **Action Center**.
### The automated email response engine provides the following advantages:
* Accelerated response: Execution of time-sensitive email response actions directly within the application interface, significantly reducing response latency.
* Unified audit and visibility: A single source of truth for all response activities. Every email action, whether through the engine or through playbooks, is seamlessly logged and fully auditable.
* Optimized analyst workflow: SOC analyst efficiency through intuitive controls and a zero-switch environment, ensuring investigations move quickly and without interruption.
### The email response engine supports the following actions:
* Soft delete email
* Undelete Email
* Report as phishing
* Send warning email
* Move Email to Folder
* Mark as Safe
* Mark as Malicious
### Note
For extra automated actions, use the playbooks, scripts, and commands in the Cortex XSIAM automation engine. For more information, see [Automation in Cortex XSIAM](../../configure-cortex-xsiam/automations/automation-in-cortex-xsiam).