Mailbox Search Options

Views:

ScanMail provides multiple search options to narrow the scope of mailbox searches. Properly configured mailbox searches reduce the usage of system resources and return only relevant search results.

Tip

Trend Micro recommends performing an estimated search before performing Search Now or Search Later. Copying large amounts of data to the discovery mailbox requires more system resources and could result in reduced performance.

Configure the following search options to streamline mailbox search matching.

Option

Description

Keywords

ScanMail searches for the keywords or phrases that the administrator specifies. Use logical operators, parentheses, double quotation marks, wildcards, or KQL expressions (for Exchange 2016 and Exchange 2019) to narrow the search parameters.

For details on searching for keywords, see Syntax Used for Keyword Strings.

Note

The maximum allowable character length of the Keywords field is 8192.

Mailboxes

Administrators may choose to search all mailboxes in the Exchange environment or choose specific users or distribution groups.

Note

Trend Micro recommends performing mailbox searches on a limited number of users or distribution groups. Copying large amounts of data to the discovery mailbox requires more system resources and could result in reduced performance.

To select Specific user or distribution group members' mailboxes:

Type a search string in the text box to find the available users, distribution groups, or databases and click Search.
Select the accounts or databases to search in the available list and click Add >>.

Alternatively, administrators can import pre-existing lists from properly formatted .txt files.

Note

The maximum allowable number of email addresses to search is 500. When importing a file, ScanMail only adds addresses to the Selected Mailbox(es) list until the list contains 500 addresses.

Mailbox Components

ScanMail can search all mailbox components in the Exchange environment or administrators may choose to scan only specific components. When choosing specific components, the following options are available:

Email
Meetings
Journal
Tasks
Contacts
Notes
Instant messaging conversations

Note

When selecting All mailbox components (including components not listed below), ScanMail includes results found in any component that exists in the Exchange mailbox.

Specific Senders or Recipients

ScanMail searches email messages addressed to the specified recipients or from the specified senders.

Note

ScanMail can search specific senders and recipients using display names, email addresses, or domain names.

Date

Administrators may choose to search all components in the Exchange environment or only those components created within a specified date range.

Discovery Mailbox

Administrators may choose to use a specific discovery mailbox for the search or accept the previously configured default Search & Destroy discovery mailbox.

Action

ScanMail provides two search actions:

Search and compile: All matched results are compiled for review (recommended)
Search and delete: All matched results are automatically deleted (not recommended)

Note

Trend Micro only recommends automatically deleting messages in high security environments.

Keywords: mailboxes,keywords,options,discovery mailbox,specific senders or recipients,mailbox components,date