In a specific period, if there are many mails from a specific sender that contains an attachment which needs to be analyzed by the sandbox, the temporary overloading of the sandbox will trigger the alerts.
To resolve the issue, do either of the following:
- If the mails from the specific sender are automatically generated mails and does not contain any malicious content, add the sender to Exception list on Policy > Exceptions.
- Go to Alerts > Rules > System: Virtual Analyzer Queue then increase the number next to "Messages:" or the time next to "Check every:" to prevent the temporary overloading notifications from showing up.