Get all external emails containing .doc

[hdsouza]

I need to find all emails containing an attachment (.doc) received by the organization in the last 30 days.

I have already tried to run the GUI on the SMA, but a max it returns if 1000 entries and we have more than 1000.

Hence is there a backend query I can run on the ESAs or SMAs?

Please help. thanks

[balaji.bandi]

have you tried selecting the maximum results to be returned ?

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118413-technote-esa-00.html

it is all how you have configured the data to be retain, if you loking to have more data to be available :

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/212101-ESA-Reporting-and-Tracking-Data-Retentio.html

https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_11_1_chapter_011101.html

[hdsouza]

Thanks for your response Balaji.

I have already tried the message center and it only returns 1000 entries.

Yes I did select max results which is 1000

What kind of query can be run on the backend to get this data?

[ppreenja]

Hello Hdsouza,

We have an enhancement request in place for increasing the limit from the hard-coded limit of 1000 entries as below:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuu63124

You can add yourself to the notifications so that you are notified once a fix in there in any future ESA Async OS releases.

There is no workaround in place currently. I hope that answers your query.

Cheers,
Pratham

[hdsouza]

Thanks Pratham. That will be very helpful.