After you create a Content Filtering policy in Symantec Messaging Gateway (SMG) that creates Content Incidents for review, the Content Incident folder does not display the expected messages. This issue occurs even though the number of new incidents in Content > Folder Overview shows new incidents for review.
In SMG versions prior to 10.0.0, the default Content Incident Folders query displayed only those incidents that were created in the past hour. If no new incidents had been created in the past hour, the incident folder would appear empty unless a new search had been run for a longer time frame.
This has been addressed in SMG 10.0.0 and later, which sets the default folder view query to "show all" rather than "last hour."