The advanced search in Compliance Search includes criteria that can be customized. If you use multiple criteria, define the relationship between them by using AND and OR conditions.
For criteria that allow multiple values, separate the values with a semi-colon (;) or a comma (,), and then assign a logical operator.
Criteria Available for Email Messages
-
Discovery
-
Domain users
-
Files accessible by
-
User groups
-
-
Email
-
Attachment name: Search by the name of the email attachment. Logical operators: OR or NOT.
-
BCC: Search by email addresses that appear in the BCC field. Logical operators: AND, OR, or NOT.
-
CC: Search by email addresses that appear in the CC field. Logical operators: AND, OR, or NOT.
-
Email address: Search by email addresses that appear in the To, From, BCC, or CC fields. If the email address is part of a distribution group email alias, the search includes email messages that have the email alias in the To, From, or CC fields. Logical operators: AND, OR, or NOT.
-
Folder: Search a mailbox folder using an exact path, a term in the path, or a pattern in the path.
-
From: Search by the name of the sender. Logical operators: OR or NOT.
-
Has attachment: Search for email messages that have attachments.
-
Received time: Search email messages based on the time that the messages were received. You can enter only one received time.
-
Size (in KB): Search by the size of the email message. You can enter a range.
-
Subject: Search by the subject of the email message. Logical operators: AND, OR, or NOT.
-
To: Search by the name of the receiver. Logical operators: AND, OR, or NOT.
-
-
Query builder
-
Raw query: When you perform a search with the query builder, keywords are not highlighted in the search results. A query can have a maximum of 1024 boolean clauses.
The following table provides the search parameter and the corresponding syntax.
Search parameter
Syntax
Keyword
(keyword)
Email subject
(Subject:<Subject name>)
from email adddress
(From:<SMTP ADDRESS>)
cc email address
(CC:<SMTP ADDRESS>)
To email address
(To:<SMTP ADDRESS>)
bcc email address
(BCC:<SMTP ADDRESS>)
Email address
(RecipientList:<SMTP ADDRESS>)
Folder name in the mailbox
(Folder_idx:<Folder_name>)
Received time
(ReceivedTime:[2022-02-01T05:00:00Z TO 2024-05-30T03:59:00Z])
Size in KB
(Size:10240+TO+20480)
Attachment name
(Attachment:<Attachment_name>)
Has attachment (true/false)
(HasAttachment:<true>) OR (HasAttachment:<false>)
Example:
(CC:<SMTP ADDRESS>) AND (RecipientList:<SMTP ADDRESS>) AND (From:<SMTP ADDRESS>) AND (ReceivedTime:[2022-02-01T05:00:00Z TO 2024-05-30T03:59:00Z])
-
-
Search options
- Language: You can select the language (Chinese simplified, English, or Japanese) of the data you want to return in the search results list.
Criteria Available for Files
-
Discovery
-
Domain users
-
Files accessible by
-
User groups
-
-
Files
-
Folder: You can provide the path of the folder. Logical operators: AND, OR or NOT.
-
Modified Date: You can provide the modification date for the file. You can either type the date in the box or select it from the calendar. Logical operator cannot be applied on this field as you can provide the modification date for only one file.
-
File name part: You can search data by specifying file name or wildcard pattern (for example: *.doc, *.pdf, etc.). Logical operators: AND, OR or NOT.
-
Size (in KB): Search by the size of the files. You can enter a range.
-
-
Query builder
- Raw query: When you perform a search with the query builder, keywords are not highlighted in the search results. A query can have a maximum of 1024 boolean clauses.
-
Search options
- Language: You can select the language (Chinese simplified, English, or Japanese) of the data you want to return in the search results list.
Criteria Available for Emails and Files
-
Query builder
- Raw query: When you perform a search with the query builder, keywords are not highlighted in the search results. A query can have a maximum of 1024 boolean clauses.
-
Search options
- Language: You can select the language (Chinese simplified, English, or Japanese) of the data you want to return in the search results list.