We have a bunch of content rules. If a message gets quarantined because it matches a term in the dictionary, I can see what was matched in the quarantine, as it is highlighted.
However, if a message is quarantined on our Attachment type content filter (looks for some mimetypes & filetypes) how do I tell which file matched and what type Ironport thinks it is. For example, an email with a .dat file was recently quarantined by this rule, but we don't specifically quarantine .dat. We do quarantine attachment-mimetype == "application/x-dosexec" and attachment-mimetype == "text/xml" (among others)
