Message data item	Description
Received Date/Time	The date and time a message was received.
Subject	The message subject.
Sender Address	The message sender email address.
Sender IP	The message sender IP address.
Recipient Address	Message recipient email address. If the message has multiple recipients, the first recipient address is displayed.
Analysis Result	Message analysis results or filter type (Clean, Virus, Spam, URL Analysis, Data Loss Prevention, Exception, Commercial Bulk, Block List, Phishing, Advanced Malware Detection - Cloud, Advanced Malware Detection - On-Premises, Email Attachment, Spoofed Email, or Custom Content). The Block List type applies to a message that is blocked by a Personal Email Manager Always Block List. When a data loss prevention (DLP) policy is indicated, a View Incident link in this column opens the incident details in the Security Manager Data Security module.
Message Status	Current message status (Delivered, Delayed, Dropped, Exception, Failed, Waiting for delivery, or Waiting for message analysis). A message with multiple recipients may have multiple status entries based on the policy applied.
From: Header	The message From: header.
Spam Score	The spam score of the message.
Message Size (KB)	The size of the message, in KB.

Option	Description
Filter	Pull-down menu functionality to select a message element on which to search: Subject Sender Address Sender IP Recipient Address Analysis Result Message Status To: Header From: Header Spam Score Message Size (KB) Appliance
Condition	Pull-down menu functionality to select a condition for the selected filtering option. The available conditions depend on the selected filter; not all conditions are available for all filters. Conditions include: Contains Does not contain Equals Does not equal Starts with Does not start with Ends with Does not end with Is Is not Is in this range Note: If you select the filter Spam Score and the condition "is" or "is not," the value of "null" can be input in the Value field. Note: If you select the filter Sender Address or Recipient Address and the filter "is" or "is not," multiple addresses can be entered in the Value field, separated by a semicolon.
Value	User-defined text field to enter a value for the filter and condition.
Add/Remove	Selection adds or removes a row of filtering options to further narrow the search.
Advanced Options	Selection displays additional sort conditions to refine the search: By Direction Inbound Outbound Internal Open Relay By Analysis Result Clean Virus Spam URL Analysis Commercial Bulk Data Loss Prevention Custom Content Exception Block List Advanced Malware Detection - Cloud Phishing Advanced Malware Detection - On-Premises Spoofed Email Email Attachment SMTP Authentication Fail RBL Reputation RDNS SPF DMARC By Message Status Delivered Delayed Dropped Exception Failed Expired Rejected

Detail Item	Description
Recipient Address	Message recipient email address. If the message has multiple recipients, this column has multiple entries.
Recipient IP	Message recipient IP address.
Direction	Message direction (Inbound, Outbound, or Internal). If the message has multiple recipients, this column may have multiple entries.
Delivered Date/Time	The date and time a message was delivered to a recipient.
Policy	Name of the policy applied to the message. If the message has multiple recipients, this column may have multiple entries.
Rule	Name of the policy rule applied to the message. If the message has multiple recipients, this column may have multiple entries for a single message. This item is blank for a message with an analysis result of Clean.
Analysis Result	Message analysis results or filter type (Clean, Virus, Spam, URL Analysis, Data Loss Prevention, Exception, Commercial Bulk, Block List, Phishing, Advanced Malware Detection - Cloud, Advanced Malware Detection - On-Premises, Email Attachment, Spoofed Email, or Custom Content). The Block List type applies to a message that is blocked by a Personal Email Manager Always Block List.
Message Status	Current message status (Delivered, Delayed, Dropped, Exception, Failed).
Quarantined?	Indicator of whether message is quarantined (Yes or No). A View link appears for a message isolated by a DLP or advanced file analysis policy.