Upvoting. We like to have the opportunity to educate clients when they download something dodgy, even if it is blocked. An email upon detection would be a very useful feature.

I would also like to add it may be best that there is a way to set it up where you can choose which events you'd get ticketed on. For instance, if the event is labeled "Quarantine Failed" "Detected" or "Remove Failed" create a ticket. Kind of in the same sense that we can only get tickets on "Critical" alerts and incidents.

If this feature is considered, I suggest to at least make it possible to turn it on/off for specific customers, with perhaps additional granularity down the road.