Searching the Quarantine

Search the quarantine by building queries with the options available on the Search Parameters sidebar. Results are displayed in the Search Results pane, where they can be viewed, approved, forwarded, saved, deleted, or reported to SophosLabs as false positives.

To search the quarantine:

  1. Define the parameters for your quarantined message search by setting one or more of the following:
    Note
    The text boxes support string-based searches. All text boxes except ID support the "*" and "%" wildcards. When using wildcards to find all or part of a domain, all search terms must be preceded by the "@" symbol. Searches are case-insensitive.
    • Sender: Enter a full or partial sender's email address.
    • Recipient: Enter a full or partial recipient's email address.
    • Subject: Enter the full subject or keywords contained in an email's subject line.
    • Start Date Range: Type the date and time in YYYY-MM-DD [hh:mm] format. If you do not specify hours and minutes, the start time is 0:00.
    • End Date Range: Type the date and time in YYYY-MM-DD [hh:mm] format. If you do not specify hours and minutes, the end time is 23:59.
    • Relay: Enter a full or partial hostname or IP address of an internal mail relay.
    • ID: Enter an identification number assigned to a message during processing. You can use this text box to search for the following types of message ID numbers:
      • Queue ID: PureMessage assigns a unique Queue ID to each message in the quarantine. To view a message's Queue ID, click the message subject, and then click Info.
      • Quarantine Digest ID: When PureMessage generates quarantine digests, each message listed in the digest is assigned an ID code.
      • Header Message ID: If the format of the search string resembles a header message ID (for example, by containing an "@" separator), the contents of this field are tested against the value in the Message-ID header. To view a message's Message-ID header, click the message subject, and then click Source.
    • Reason: From the drop-down list, select the reason that the email was quarantined. The available options include Spam, Blacklisted, Virus, and Suspect. The default is to search for any of these reasons.
    • Results to Display: From the drop-down list, select the number of results rows to display at one time. The minimum is 20 and the maximum is 1,000.
  2. Click Search.

    Matches for the search are displayed in a table in the Search Results pane. The total number of results is displayed at the bottom left of the pane.