> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/email-threats/investigate/email-threat-issue-search.md).

# Email Threat Issue Search

{% stepper %}
{% step %}

#### Search in Issues

Begin any Email Threat Issue search directly from the [Issues page](#search-by-subject-or-sender).
{% endstep %}

{% step %}

#### Message Explorer

If you need to narrow your search down with more specific parameters, then move on to leverage the [Message Explorer](#focused-message-search-in-the-message-explorer).
{% endstep %}
{% endstepper %}

***

## Search in the Issues Page

From the Email Threats Issues page, use the issue search bar to narrow the list by:

* Sender address
* [`messageId`](#copy-message-id-copy-message-link-or-share-with-material)
* `caseId`
* Message subject
* Receiver display name

<figure><img src="/files/WOXXAmUAzX3YsP0yARKT" alt=""><figcaption><p>Search by subject or sender</p></figcaption></figure>

***

## Focused Message Search in the Message Explorer

{% @arcade/embed url="<https://app.arcade.software/share/dkuaaTRMTIIWERxcHRdD>" flowId="dkuaaTRMTIIWERxcHRdD" %}

Use the Explorer to search message content in any issue.

1. From the left navigation, expand **Explorer.**
2. Click **Messages**.

<figure><img src="/files/QZac9gdRbxaqVzzcQ5fS" alt=""><figcaption></figcaption></figure>

You can use any combination of the keywords specified in the app (separated by space) to filter your search results. The NOT (-) logical operator is supported to negate keywords (e.g. -to:<someone@example.com>). Regular expressions are supported by using regexp() (e.g. to:"regexp(^some.\*@example.com$)").

{% hint style="success" %}
**Learn RegEx**

* [CodeAcademy Lessons](https://www.codecademy.com/learn/introduction-to-regular-expressions)
* [W3Schools Reference](https://www.w3schools.com/jsref/jsref_obj_regexp.asp#gsc.tab=0)
  {% endhint %}

Operators are defined in the drop down as you begin typing. Select options from the drop down, add a space to see the next options:

<figure><img src="/files/LTC8ldVbL2yQQQS0aRM6" alt=""><figcaption><p>Explorer > Message Search</p></figcaption></figure>

{% hint style="info" %}
**Careful to encase in quotes properly**

Be sure sure to properly quote the values or you will run a much slower full-text search.

For example, you might want to search anything sent `from:"jane@example.com",`

but if you type `from:"jane@example.com`

you will get a full text search of any email containing the **string** `"from:"jane@example.com"` , rather than the sender you were looking for.
{% endhint %}

### Narrow to just messages in an Email Threat issue

From the type field, select **Suspicious**:

<figure><img src="/files/VjAc70YqPVpTGGmqeOVn" alt="" width="178"><figcaption></figcaption></figure>

### Open an issue found in message search

From the search results list, open the **message details** then click **Issue**.

***

## Search with the Message Explorer Directly from an Issue

1. Begin in a specific issue.
2. Scroll down, then click a message title to open the **Message Details**.

<figure><img src="/files/JB0OWrDZOkchhSqmOShA" alt=""><figcaption><p>Click the message title to open message details</p></figcaption></figure>

3. In the **From** field, click the **Sender Address**.
4. Click **Search messages.**

<figure><img src="/files/gKDZ6vA0XlqG7W2ukCUs" alt="" width="375"><figcaption><p>Click the sender address to view the Block option</p></figcaption></figure>

5. The message explorer opens pre-populated with a query searching for all messages from this sender.

***

## Copy Message ID, Copy Message Link, or Share with Material

Sometimes you need to share the message ID or share the message itself with us so we can help you troubleshoot. Find the message in the Explorer then click **All actions** (or use the keyboard shortcut `⌘K`), then click **Copy Message ID** and/or **Share With Material**:

<figure><img src="/files/Zf3a76LEBYnLkQ8R27u8" alt="" width="375"><figcaption><p>Message Detail View > All Actions</p></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/learn-more/risk-areas/email-threats/investigate/email-threat-issue-search.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.