> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Inbound attachment threat scan

> How Devotel Orbit byte-scans every inbound email attachment for threat signals before it is archived — the clean/suspicious/malicious verdict bands, the allow/quarantine action each maps to, and how a quarantined part is recorded on the message metadata without ever serving its bytes.

# Inbound attachment threat scan

Every inbound email attachment that arrives at a domain you point at Orbit
passes through a byte-level threat scan — the same gate inbound MMS media
passes — before it reaches your agents or your recipients. One action follows
a part's verdict: **allow** and archived to the media store, or **quarantine**
and dropped before any byte is uploaded.

The whole model is tenant-level policy: your account's policy decides which
verdicts reach your agents, and the metadata keys below are the audit record
of every drop.

## Verdict bands — clean, suspicious, malicious

The scan composite-scores a small set of independent, machine-readable signal
classes and cuts the score into three bands. The bands are coarse by design —
you see a verdict, not a wiring diagram.

| Band           | Signal class                                                                                                                    | Action                        |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |
| **clean**      | No threat signals                                                                                                               | Archived                      |
| **suspicious** | Advisory signals (unusual container, an archive that can smuggle a payload, a MIME mismatch)                                    | Archived — flagged for review |
| **malicious**  | Executable payloads, macro-carrying Office documents, embedded scripts, anti-virus test signatures, deceptive double extensions | Quarantine — dropped          |

Signal classes (each matched class adds points to the score; the band is the
cutoff the score crosses):

| Signal class            | What it catches                                                                                          |
| ----------------------- | -------------------------------------------------------------------------------------------------------- |
| Executable signatures   | Windows/DOS/portable-executable, Linux, macOS, or Java executables; script shebangs; Windows shortcuts   |
| Macro-capable documents | Legacy OLE compound documents; an OOXML package carrying an embedded macro project                       |
| Embedded scripts        | An inline `<script>` in SVG/HTML; event handlers or a `javascript:` URI; PHP code                        |
| Active PDF content      | `/JavaScript`, `/Launch`, `/OpenAction` inside a PDF                                                     |
| Filename deception      | Double extension (`invoice.pdf.exe`), a dangerous content-type, an executable or macro-enabled extension |
| Archive containers      | `zip`, `rar`, `7z`, `iso` — a lower-risk container a payload can ride inside                             |

Every quarantined message records the per-part breakdown as machine-readable
finding codes so you can audit why a specific part was dropped.

## The allow / quarantine action

Two actions follow from the band:

| Band       | Action                                                                                               |
| ---------- | ---------------------------------------------------------------------------------------------------- |
| clean      | **allow** — archived to the tenant's media store                                                     |
| suspicious | **allow** — archived for review; warn-flagged                                                        |
| malicious  | **quarantine** — the part is dropped; the message metadata below carries only PII-safe finding codes |

A `quarantine` verdict drops the part **before it is uploaded**: the part
never reaches the media bucket, never lands in an agent inbox, and serves no
bytes to your recipients. A `suspicious` part still archives — your agent sees
it, and the flag tells your team to look.

## The metadata contract

The scan stamps onto each message row in one pass, so the audit trail shows
both outcomes:

* `metadata.email_attachments` — the archived **allow** parts, in the same
  `{ filename, url, content_type, size }` shape the outbound send path writes,
  so the message detail view renders each entry with a re-freshed download URL.
* `metadata.email_attachments_quarantined` — the quarantined parts, one entry
  per part: `filename`, `content_type`, `size`, `score`, the `band`, and the
  `finding_codes` of each matched signal. No raw bytes, no sender content.

A message whose inbound email declared attachments stays **metadata-only** in
the inbound-parse webhook payload — the keys above are the archive/audit
contract the forward cannot inline.

## Worked JSON sample

```json theme={null}
{
  "metadata": {
    "email_attachments": [
      {
        "filename": "order-confirmation.pdf",
        "url": "https://storage.../order-confirmation.pdf?sig=…",
        "content_type": "application/pdf",
        "size": 84321
      }
    ],
    "email_attachments_quarantined": [
      {
        "filename": "invoice.pdf.exe",
        "content_type": "application/x-msdownload",
        "size": 90112,
        "score": 75,
        "band": "malicious",
        "finding_codes": ["double_extension"]
      }
    ]
  }
}
```

## Troubleshooting

**My recipient says an attachment is missing.** Check
`metadata.email_attachments_quarantined` before treating the send as a
delivery failure — a quarantined part's entry names the part and the finding
codes. If the key is absent, the part archived and the recipient-side issue
is elsewhere (the media-store URL, or the view the recipient uses).

## See also

<CardGroup cols={2}>
  <Card title="Inbound email and SMS routing" href="/guides/inbound-email-parse">The end-to-end inbound email guide this quarantine model plugs into.</Card>
  <Card title="Email attachments" href="/guides/email-attachments">Limits and MIME rules for sending.</Card>
  <Card title="Media file upload and presign lifecycle" href="/concepts/file-upload-and-presign-lifecycle">The object-storage plane the archived media lands in.</Card>
  <Card title="Settings → Media" href="/guides/settings-media-console">Work quarantined uploads under Settings → Media.</Card>
</CardGroup>