When a riskware alert is generated in a Helix Enterprise environment, the Email Security - Server appliance automatically informs Helix Enterprise about the alert and makes the alert information available to Helix Enterprise. The Email Security - Server appliance passes Helix Enterprise a JSON object that contains key details about the alert and a link back to a file that the appliance stores for that alert.
This feature is automatically enabled when you enable riskware detection on the Email Security - Server appliances deployed in Helix Enterprise mode.