Skip to main content

​
Overview

The Remediation Actions panel guides you through the 6 steps of remediating an account compromise:
  1. Revoke Sessions and Lock Account
  2. Retract Phishing Emails
  3. Disable Persistence Mechanisms
  4. Reset Password
  5. Re-enable Account
  6. Mark as Remediated

Remediation Actions Panel

​
Step 1: Revoke Sessions and Lock Account

Revoke Sessions and Lock Account should be your first action when remediating a compromise
In the Remediation Actions panel, click the Revoke Sessions and Lock Account button to immediately:
  • Terminate all active user sessions
  • Lock the compromised account
  • Prevent further unauthorized access
Revoke Sessions and Lock Account works for all account types, including on-prem synced and hybrid accounts.

​
Step 2: Retract Phishing Emails

Similar phishing emails are identified automatically and can be moved to Deleted Items.
Similar Phish Retraction

Stop others from falling for the same phish

​
Mark as Phish

Petra tags the phishing email on the incident automatically in most cases. When it can’t, you’ll need to tag it yourself so that retraction, cross-tenant search, and reporting know which email is the phish. To tag manually: open the incident, find the suspicious email in the Exchange Logs, hover over it, and click Mark as Phish. The email will show a Phish badge next to the subject line once it’s tagged.
Mark as Phish tags the email as the phishing email for the incident. It does not remove the email from inboxes. Use the retraction button in Step 2 to move it to Deleted Items across the tenant, or Cross-Tenant Phish Removal for matching emails across other tenants.

​
Cross-tenant phish retraction

If you manage multiple tenants, Petra identifies matching phishing emails across all of your managed tenants and surfaces them in the Cross-Tenant Phish panel below the tagged phish in the incident’s Remediation Actions panel. This panel shows each tenant where the same phish was found, along with the sender, subject, and affected mailboxes. You can select individual emails or entire tenants for retraction. Clicking a tenant name opens that tenant’s Email tab with the subject and sender filters pre-populated, so you can review before taking action.
Cross-Tenant Phish Revocation

Cross-Tenant Phish Revocation in the Remediation Actions panel

Spotted a phish in the wild that isn’t tied to an incident and want to sweep it across every tenant you manage? See Cross-Tenant Phish Removal for the proactive, ad hoc flow.

​
Recover Emails Deleted by the Attacker

Attackers routinely delete emails to cover their tracks, hiding sent phishing emails, wiping replies from victims, or clearing sign-in notification emails from the compromised mailbox. Petra surfaces these deletions in the Recover Deleted Emails card of the Remediation Actions panel. The card is built from the incident’s Exchange audit logs, so it covers deletions across the affected mailboxes tied to the incident, not only the primary compromised account.
Recover Deleted Emails card in the Remediation Actions panel

Recover emails the attacker deleted from the compromised mailbox

The card lists every attacker-attributed email deletion during the incident window, with the original folder, sender, subject, and when it was deleted. Each email has a status:
  • Restored: the email is already back in the mailbox
  • Not restored: the email is still recoverable (sitting in Deleted Items or the Recoverable Items folder)
  • Unrecoverable: the email is gone for good
To recover, select individual emails and click Recover Deleted Emails, or use the dropdown to Recover all to Inbox. Recovered emails return to their original folder, or to the Inbox when you choose that option.
Recover Deleted Emails restores evidence; it does not remove attacker access. Always complete the access-ending steps (revoke sessions, lock the account, reset the password) first, then use recovery as part of the cleanup.

​
Why some emails cannot be restored

To understand recoverability, it helps to know how Exchange Online deletions work. A deleted email moves through a sequence of locations, and each step further along means less chance of getting it back:
  1. Deleted Items (the trash folder). A normal delete lands here. Petra can recover emails from Deleted Items.
  2. Recoverable Items \ Deletions (the “dumpster”). Emails land here when they’re removed from Deleted Items explicitly, or when Deleted Items is emptied. Users can’t see this folder, but the emails are still retrievable. Petra can recover these too.
  3. Recoverable Items \ Purges. A hard delete (Shift+Delete / programmatic hard delete) goes straight here, skipping both previous folders, and anything removed from the dumpster is purged here as well. Emails in Purges can’t be moved back into the mailbox by end users, admins, or Petra. The one exception: if the mailbox is on litigation hold or covered by a retention policy, purged items are preserved and can still be surfaced through eDiscovery, but that’s legal-hold preservation, not restoration to the mailbox.
  4. Retention expiry. Even the dumpster is time-limited: Exchange Online keeps soft-deleted items for 14 days by default (configurable up to 30 days in the tenant’s retention settings). Once that window closes, the item is permanently removed.
With that in mind, an email shows as Unrecoverable in Petra when it falls into one of these cases:
  • Hard-deleted: the attacker used a hard delete instead of a normal one, sending the email straight to Purges. Sophisticated attackers do this deliberately to destroy evidence.
  • Purged after a second deletion pass: the email was soft-deleted normally, but was later removed from the dumpster, either manually by the attacker covering their tracks more thoroughly, or by automated mailbox clean-up (Managed Folder Assistant processing, quota pressure).
  • Past the recovery window: the deletion happened long enough ago that the 14–30 day retrieval window has closed. This is common when an incident is investigated weeks after the fact.
  • Petra couldn’t verify the email’s location: if Petra can’t reach the mailbox (for example, missing or expired Microsoft permissions), it can’t confirm where the email is and errs on the side of showing it as unrecoverable. Fix the permissions and the status may update to Not restored on the next check.
Unrecoverable emails can’t be recovered by Petra or by Microsoft, but they still appear in the card, the incident timeline, and the incident PDF so you have a record of what the attacker destroyed.

​
Step 3: Disable Persistence Mechanisms

Attackers often create persistence mechanisms to maintain access even after password changes. Petra identifies these mechanisms and lets you one-click disable them. These include:
  • Mail filter rules
  • App registrations
  • Service principals
  • Malicious device registrations
  • Phishing emails sent internally
  • Phishing emails still in mailboxes in your environment
Remediate inbox rules and app registrations

Remediate inbox rules and app registrations

All of these persistence mechanisms are auto-identified and can be removed in one click. Use the Remediation Actions Panel to remove them.

​
Step 4: Reset Password

After removing all persistence mechanisms:
  1. Click the “Reset Password” button. This will generate a new password string and apply it to the account. It will then show you that new password.
  2. Communicate the new password securely to the user. We recommend calling them.

​
Step 5: Re-enable Account

After resetting the password, you can re-enable the account.

​
Step 6: Mark as Remediated

Once all remediation steps are complete:
  1. Click “Mark as Remediated”
  2. This changes the incident status to “Remediated”
  3. The remediation panel will auto-hide for cleaner viewing

​
Post-Remediation

After remediation, the incident page remains available for:
  • Generating incident reports
  • Exporting data to share with clients
  • Reviewing the incident timeline and details
  • Further investigation if needed
You can always expand the remediation panel again if you need to review or modify any remediation actions taken.
The Demo Tenant (Acme Corp) is a phenomenal place to see all of this in action.