Mailbox Search Criteria Parent topic

ScanMail provides multiple search criteria options to narrow the scope of mailbox searches. Properly configured mailbox searches reduce the usage of system resources and return only relevant search results.
Tip
Tip
Trend Micro recommends performing an estimated search before performing Search Now or Search Later. Copying large amounts of data to the discovery mailbox requires more system resources and could result in reduced performance.
Configure the following search criteria options to streamline mailbox search matching.

Mailbox Search Criteria Options

Criteria
Description
Keywords
ScanMail searches for the keywords or phrases that the administrator specifies. Use logical operators, parentheses, double quotation marks, wildcards, or AQS expressions to narrow the search parameters.
For details on searching for keywords, see Syntax Used for Keyword Strings.
Note
Note
The maximum allowable character length of the Keywords field is 8192.
Mailboxes
Administrators may choose to search all mailboxes in the Exchange environment or choose specific users or distribution groups.
Note
Note
Trend Micro recommends performing mailbox searches on a limited number of users or distribution groups. Copying large amounts of data to the discovery mailbox requires more system resources and could result in reduced performance.
To select Specific users or distribution groups:
  1. Type a search string in the Search by display name of the user or distribution group text box and click Search.
  2. Select the accounts to search in the Available Mailbox(es) list and click Add >>.
Alternatively, administrators can import pre-existing mailbox lists from properly formatted .txt files.
Note
Note
The maximum allowable number of email addresses to search is 500. When importing a file, ScanMail only adds addresses to the Selected Mailbox(es) list until the list contains 500 addresses.
Mailbox Components
ScanMail can search all mailbox components in the Exchange environment or administrators may choose to scan only specific components. When choosing specific components, the following options are available:
  • Email
  • Meetings
  • Journal
  • Tasks
  • Contacts
  • Notes
  • Instant messaging conversations
Note
Note
When selecting All mailbox components (including components not listed below), ScanMail includes results found in any component that exists in the Exchange mailbox.
Specific Senders or Recipients
ScanMail searches email messages addressed to the specified recipients or from the specified senders.
Note
Note
ScanMail can search specific senders and recipients using display names, email addresses, or domain names.
Date
Administrators may choose to search all components in the Exchange environment or only those components created within a specified date range.
Discovery Mailbox
Administrators may choose to use a specific discovery mailbox for the search or accept the previously configured default Search & Destroy discovery mailbox.