For the Malicious Content rule, it should be possible to download a malicious file directly from a Shield Alert for sandboxing without having to search for it.

Also, an admin who has Content Manager access should be able to click a button within the alert and navigate to the file in the Content Manager to manage it.