Creating a saved search query

From the email archive

1. Log in to the Cyber Protect console as administrator.
2. Go to Backup storage > Backups > Cloud application backups.
3. [If you want to search in an email archive in immutable storage] Click Show deleted.
4. Select an email archive, and then click Browse archive.
5. [If a privacy warning is shown] In the Privacy warning dialog, click Proceed.
6. In the Encryption password dialog, specify the password, and then click Proceed.

7. Select the level on which you want to perform the search.

   You can select All emails, a user mailbox, or the Incoming or Outgoing folder in a user mailbox.

8. To search for the mailbox of a specific user, in the left-column search field, type at least three characters of the user name, and then press Enter.

   

9. On the main screen, click Search, specify your search query, and then click Search.

   

   You can use one or more words. To search for a specific phrase, put the phrase in quotation marks. Wildcards are not supported.

   The search is performed in the following fields:

   • From
   • To
   • CC
   • BCC
   • Subject
   • Email body

10. To search only in a specific field, such as From, To/CC/BCC, Subject contains, or to specify additional search criteria, click Filter.

    1. Configure your search criteria.

       For example, you can search only for emails that have attachments, or emails that were sent or received on a specific date.

    2. In Deletion status, select the search scope.

       Selecting Non-deleted items limits the search only to emails that are not in immutable storage.

       Selecting Deleted items limits the search only to emails that are in immutable storage.

    3. Click Apply.
11. Click Save as.
12. In the Search query name, specify a name.
13. Click Save.

As a result, a saved search query is created and is shown in the Saved search queries section. Search results are dynamic and include all new emails that match the query.

The search query is linked to this email archive and can run only on it. Do not use this search query in a retention rule or legal hold rule that you want to apply to another email archive.

From Management > Archiving plans

1. Log in to the Cyber Protect console as administrator.
2. Go to Management > Archiving plans > Search queries, and then click Add search query.

3. In Search query name, specify a name.

4. Select an email archive to which you want to link the search query.

   If you select an email archive, you will be able to run the query only on that archive.

   If you do not select an email archive, you will be able to apply the query on any email archive.

5. In Search query, specify your search query.

   You can use one or more words. To search for a specific phrase, put the phrase in quotation marks. Wildcards are not supported.

   The search is performed in the following fields:

   • From
   • To
   • CC
   • BCC
   • Subject

   Alternatively, you can search in these fields separately, by using the From, To/CC/BCC, and Subject contains fields.

6. In Deletion status, select the search scope.

   Selecting Non-deleted items limits the search only to emails that are not in immutable storage.

   Selecting Deleted items limits the search only to the emails that are in immutable storage.

7. Specify additional search criteria.

   For example, you can search only for emails that have attachments, emails that were sent or received on a specific date, or emails with a specific size.

8. Click Create.

As a result, a new saved search query is created. Search results are dynamic and include all new emails that match the query.