Email Security.cloud

The Email Track and Trace tool now supports Enhanced View, which provides a streamlined interface for complex querying.

In the Email Track and Trace tool, toggle the Enhanced View switch in the upper-right corner.
Choose a Time Range: Select from preset ranges (15m to 30d) or use Custom to define specific dates.
- Note: It takes up to five minutes for an email to be indexed after processing; searches for very recent windows may return incomplete results.
Define your Search:
- Quick Filters (Default): Use these for standard searches. Fields include Envelope Sender, To, Subject, Message ID, Scan Service, Scan Action, Scan Reason, Attachment, and Sender IP/Hostname.
- Custom Filters: Build complex, multi-condition queries. You can combine fields (such as Attachment Checksum, Direction, or URL Count) using AND/OR operators and grouping parentheses to build specific logic.

The following best practices will help you optimize your searches for Email Track & Trace.

Limit the time window and refine your search criteria

For the best results, limit the time window and refine your search criteria.

If you know the specific time window of the email you are attempting to locate, restrict the search to a shorter time period (days or hours). This provides a quicker search response.
Using one or more indexed fields in your search criteria will significantly improve search performance.
- Subject
- Service
- Sender IP
- Sender Address
- Recipient Address
- Time stamp
- Date
Add fields in the "Select more search options" where available; add a Service, Sending server, external IP etc. to significantly narrow the search results.
Please note, it will take up to 15 minutes to display new email transactions on Track and trace.

Result format (UI vs CSV files)

When asking for results in the UI versus asking for a CSV file through email, consider the following:

UI - The UI will return results for up to 2,000 rows.
- If you expect that results will be greater than 2,000 rows, request a CSV file to be emailed.
CSV - The CSV file will deliver results up to 10,000 rows.

How long should a report take?

Results should return in the UI within seconds or minutes.
- The search will time out if it is too complex and/or takes over 30 minutes to complete.
Results that are requested via emailed CSV can arrive within minutes.
- During peak periods, results may take a few hours depending on the query load.

What causes timeouts and failed searches?

Using any non-indexed fields (indexed fields are listed above) for searches, especially multiple non-indexed fields, will greatly increase the chances of a failed search.

Note: We have recently surveyed the most frequently used non-indexed fields and we are working to add them to our next release. If non-indexed fields are essential in the search then adding one or multiple indexed fields, in addition, will improve the chances of success.
When searching on a subject field based on a word, use all the characters you have. For example:
- Don't use the letters "Ref" when searching for the word "Referral" as you significantly increase the chances of a failed search by widening the search parameters.
- Additionally, using "subject starts with" or "subject ends with" provides faster results than "subject contains".

Option	Description
Anti-Spam	Detects and manages suspected spam, marketing, and newsletters.
Anti-Malware	Scans for malware and emerging threats.
Protection Policy	Matches rules in your Scan-time or Click-time protection policies.

Option	Description
Blocked	The email was blocked and deleted.
Quarantined	Held in Admin or User Quarantine.
Subject Tagged	Tag added to the subject line.

For more information about Email Track & Trace, see: