Message Center

The Forcepoint Email Security Cloud Message Center is a powerful message tracking and management tool that provides access to all quarantined messages and message logs for your account.

To access the Message Center, select Email > Messages > Message Center. You are presented with a search form.

The search form lets you search for messages based on several layers of search criteria, such as the From, To, or Subject fields, the date sent, whether the message contained spam or a virus, and much more. The check box controls allow a granular search for clean email and/or those with an issue that caused Forcepoint Email Security Cloud to perform an action.


	Note Enter as much detail as possible to minimize the data returned and so reduce the time that the search takes. This is especially important for large accounts.

Select the type of message for which you are looking. If you search for accepted messages, only clean messages are returned; if you search for quarantined messages, only quarantined messages are returned. You can also search for messages that have had certain actions performed on them, for example messages that have been released, forwarded, or deleted from quarantine. Information on deleted messages still appears in the search results, even though they have been deleted from the quarantine itself and cannot be viewed.


	Note To display deleted messages you must search for them specifically from the search drop-down list, or check the Show deleted messages box.

Show

Once a message it is viewed by an end user or administrator, it is marked as reviewed. If an end user has viewed a multi-recipient message, it is shown as partially reviewed. If an administrator views a multi-recipient message, it is shown as reviewed for all recipients.

Date sent

You must specify a date range to search. The more exact the date range, the faster a search completes. The default drop-down list allows you to choose common ranges; for more exact time ranges, click more and use the calendar picker.

Clicking more reveals the date range. From here you can specify exact dates and times (by the hour) to search. Click the calendar icon to open the calendar picker. Choose the date of interest by clicking the relevant date link. This closes the pop up and populates the appropriate field with the date. You can select the To and From hour from the drop-down lists. The default is to search all hours in the selected day.

From

The sender of the email; you can include a wildcard in the search by entering an asterisk (*) character to denote multiple characters.

The recipient of the email; you can include a wildcard in the search by entering an asterisk (*) character.

Subject

The email subject; you can include a wildcard in the search by entering an asterisk (*) character.

Email direction

Select the direction to search: Inbound, Outbound, or Both.

When you select Outbound, the Delivery status drop-down appears if TLS reporting is enabled for your account.

Results per page

The number of results to display per page.

Show deleted messages

Indicate whether you want deleted messages to be included in the search results.

Delivery status

Select the delivery status for outbound messages. The default is to search for all messages; you can filter on messages delivered with TLS, delivered without TLS, pending delivery, or delivery failed.

This option only appears if TLS reporting is enabled for your account and you select Outbound for the email direction.

Clean

Indicate whether you want uninfected, non-spam messages to be included in the search results.

General


Access control	Messages blocked by an access control policy. This applies only to customers that have been asked to implement access controls by Forcepoint Email Security Cloud operations.
Operational	Messages blocked by controls set up by Forcepoint Email Security Cloud operations in response to a virus outbreak.
Message loop	Messages stopped automatically because they are part of a message loop caused by auto-forwarding or auto-replying.
System	Messages that could not be processed, for example, messages that contravene email protocols.

Antivirus


Virus	Messages that contain known viruses as identified by one of the commercial antivirus engines used in the Forcepoint Email Security Cloud service.
Macro	Messages that contain highly suspicious Microsoft Office document macros that operate outside the document, that you have chosen to quarantine under your policy.
Blocked executable	Messages that contain an executable file attachment that you have chosen to quarantine under your policy.
Phishing	Messages that are suspected to be phishing emails.

ThreatSeeker Intelligence


Format	Messages that deliberately attempt to expose vulnerabilities in email software with unusually formatted headers or body.
Dangerous content	Messages that contain potentially dangerous content.
Greylisted	Messages that contain executable content that is temporarily quarantined awaiting confirmation that it is safe for automatic release.
Potential viruses	Messages that contain potential viruses, identified by Forcepoint ThreatSeeker Intelligence but not yet identified by one of the commercial antivirus analyzers used within the Forcepoint Email Security Cloud service.
Confirmed viruses	Messages that contain a virus, identified by Forcepoint ThreatSeeker Intelligence and subsequently confirmed by one of the commercial antivirus analyzers.
File Sandboxing	Messages that have been analyzed by the File Sandbox. You can refine this further by selecting a File Sandboxing status from the drop-down list: choose from All, Clean, Malicious attachment(s), Malicious and pending further analysis, and Pending analysis.

Antispam


Spam	Unsolicited bulk messages. You can select a maximum and minimum spam score range to narrow this search further.
In blocklist	Messages that are in blocklist by the default or per-user policy.
In allowlist	Messages that are in allowlist by the default or per-user policy.
Bulk	Outbound messages that have been classified as bulk messages.
Commercial bulk email	Inbound messages that have been classified as commercial bulk email by the default or per-user policy.

Content Filter


Too large	Messages that exceed any size limits defined by the policy.
Extension masked	Delivered messages that contain an attachment whose file extension was masked as specified in the content filtering policy. You can restrict searches to one or more specific extensions by listing them in the associated field, separated by commas.
Blocked attachment	Messages that have been quarantined due to their file type being specified in the content filtering policy. You can restrict searches to one or more specific extensions by listing them in the associated field, separated by commas.
Lexical rule	Messages that have contravened a lexical rule in the content filtering policy. You can restrict searches to specific sub-reasons—either messages caught by the lexical filter or messages that have experienced analysis failure—by selecting the relevant option from the drop-down list.
Blocked images	Messages that contain an image attachment that has been analyzed and is considered inappropriate. Messages with this status may also have been quarantined because the image could not be analyzed, for example because it was too large. This option only appears if you are licensed for the Forcepoint Email Security Image Analysis Module.
Copy kept	Messages marked as available for delivery, but with a copy kept for review by administrators. If you have exceeded your quota for this type of message, the message delivery is logged, but you cannot view the content. To free quota space, delete some messages. Note that messages with this status may also have been caught by the lexical filter and quarantined for other reasons.

Encryption


TLS	Messages that policy dictates should be delivered using TLS whose delivery failed because the sender attempted to send them in the clear.
Ad hoc	Messages that triggered a standard encryption policy rule.
Advanced	Messages that triggered an advanced encryption policy rule. This option only appears if you have enabled advanced encryption.