Email Threat Issue Search

1

Search in Email Threats issues

Begin any Email Threat Issue search directly from the Email Threats > Issues page.

2

Message Explorer

If you need to narrow your search down with more specific parameters, then move on to leverage the Message Explorer.

---

Search in Email Threats Issues

From Email Threats > Issues, use the issue search bar to narrow the list by:

• Sender address
• messageId
• caseId
• Message subject
• Receiver display name

Search by subject or sender

---

Focused Message Search in the Message Explorer

Use the Explorer to search message content in any issue.

1. From the left navigation, expand Explorer.
2. Click Messages.

You can use any combination of the keywords specified in the app (separated by space) to filter your search results. The NOT (-) logical operator is supported to negate keywords (e.g. -to:[e-mail]). Regular expressions are supported by using regexp() (e.g. to:"regexp(^some.*@example.com$)").

Learn RegEx

• CodeAcademy Lessons
• W3Schools Reference

Operators are defined in the drop down as you begin typing. Select options from the drop down, add a space to see the next options:

Explorer > Message Search

Careful to encase in quotes properly

Be sure sure to properly quote the values or you will run a much slower full-text search.

For example, you might want to search anything sent from:"[e-mail]",

but if you type from:"[e-mail]

you will get a full text search of any email containing the string "from:"[e-mail]" , rather than the sender you were looking for.

Narrow to just messages in an Email Threat issue

From the type field, select Suspicious:

Open an issue found in message search

From the search results list, open the message details then click Issue.

---

Search with the Message Explorer Directly from an Issue

1. Begin in a specific issue.
2. Scroll down, then click a message title to open the Message Details.

Click the message title to open message details

1. In the From field, click the Sender Address.
2. Click Search messages.

Click the sender address to view the Block option

1. The message explorer opens pre-populated with a query searching for all messages from this sender.

---

Copy Message ID, Copy Message Link, or Share with Material

Sometimes you need to share the message ID or share the message itself with us so we can help you troubleshoot. Find the message in the Explorer then click All actions (or use the keyboard shortcut ⌘K), then click Copy Message ID and/or Share With Material:

Message Detail View > All Actions