Procedure

1. Go to Mail Areas & Queues → Query.
   The Mail Areas & Queues Management screen appears. The Quarantine tab displays by default. If it does not display, click Quarantine.
2. Under Criteria, configure the following:
   • Search: Select the quarantine area, the reason the message was quarantined, and the scanner that scanned the message.
   • Dates: Select a date and time range.
3. Specify values for the following:
   • Sender
   • Subject
   • Recipient(s)
   • Violating Attachment(s)
   • Rule
   • Message ID

   Note When querying a message containing multiple recipients or violating attachments, type *string* (where string is the name of one of the recipients or attachments).

4. Click Display Log. The results appear at the bottom of the screen showing the timestamp, sender, recipient, subject, and reason for quarantining the message.
5. To change the display, do any of the following:
   • To sort the table, click any of the column headings (except reason).
   • If too many items appear on the list, click the arrow buttons on top of the list to move to the next page or select the desired page to view from the drop-down list.
   • To change the number of items that appears in the list at a time, select a new display value from the drop-down list at the bottom of the table.
6. To view details about any quarantined message, click the timestamp for the item. The Quarantine Query screen appears showing the message and all of its details.
7. To resend any message, click the check box next to it in the query result table, and then click one of the following options:
   • Deliver: The message is sent directly to the recipient, bypassing all rules except virus scan rules.
   • Reprocess: The message only bypasses the current rule, and may be quarantined again by other filters.

   Tip Trend Micro does not recommend resending messages that violated antivirus filters. Doing so could put your network at risk.

8. To delete any message, click the check box next to it in the query result table, and then click Delete.

   Note IMSVA only records and shows the violating attachment names if you have specified Attachment as a scanning condition. However, if the number of attachments in the message exceeds the maximum number specified in condition, the attachment name will not be shown.