Mailbox Search Options Parent topic

ScanMail provides multiple search options to narrow the scope of mailbox searches. Properly configured mailbox searches reduce the usage of system resources and return only relevant search results.
Tip
Tip
Trend Micro recommends performing an estimated search before performing Search Now or Search Later. Copying large amounts of data to the discovery mailbox requires more system resources and could result in reduced performance.
Configure the following search options to streamline mailbox search matching.

Mailbox Search Options

Option
Description
Keywords
ScanMail searches for the keywords or phrases that the administrator specifies. Use logical operators, parentheses, double quotation marks, wildcards, or KQL expressions (for Exchange 2016 and Exchange 2019) to narrow the search parameters.
For details on searching for keywords, see Syntax Used for Keyword Strings.
Note
Note
The maximum allowable character length of the Keywords field is 8192.
Mailboxes
Administrators may choose to search all mailboxes in the Exchange environment or choose specific users or distribution groups.
Note
Note
Trend Micro recommends performing mailbox searches on a limited number of users or distribution groups. Copying large amounts of data to the discovery mailbox requires more system resources and could result in reduced performance.
To select Specific user or distribution group members' mailboxes:
  1. Type a search string in the text box to find the available users, distribution groups, or databases and click Search.
  2. Select the accounts or databases to search in the available list and click Add >>.
Alternatively, administrators can import pre-existing lists from properly formatted .txt files.
Note
Note
The maximum allowable number of email addresses to search is 500. When importing a file, ScanMail only adds addresses to the Selected Mailbox(es) list until the list contains 500 addresses.
Mailbox Components
ScanMail can search all mailbox components in the Exchange environment or administrators may choose to scan only specific components. When choosing specific components, the following options are available:
  • Email
  • Meetings
  • Journal
  • Tasks
  • Contacts
  • Notes
  • Instant messaging conversations
Note
Note
When selecting All mailbox components (including components not listed below), ScanMail includes results found in any component that exists in the Exchange mailbox.
Specific Senders or Recipients
ScanMail searches email messages addressed to the specified recipients or from the specified senders.
Note
Note
ScanMail can search specific senders and recipients using display names, email addresses, or domain names.
Date
Administrators may choose to search all components in the Exchange environment or only those components created within a specified date range.
Discovery Mailbox
Administrators may choose to use a specific discovery mailbox for the search or accept the previously configured default Search & Destroy discovery mailbox.
Action
ScanMail provides two search actions:
  • Search and compile: All matched results are compiled for review (recommended)
  • Search and delete: All matched results are automatically deleted (not recommended)
    Note
    Note
    Trend Micro only recommends automatically deleting messages in high security environments.