Reporting of released mails

[AndreasEisele]

Hello community,

is there a report which mails have been released in the last x days?

I need a report how many mails have been released from the different quarantines.

Thanks a lot

Andreas

[dmccabej]

Hello,

I do not believe we have any reports for this, but, you could always search through the mail logs in the CLI for messages that have been released.

Some example commands:

grep "released from" mail_logs

grep "targeted for release" mail_logs

Thanks!

-Dennis M.

[AndreasEisele]

Hello Dennis,



i've tried your solution.

It doesn't match our requirements. The result shows all released messages (without taking care if the release was initiated manually or automatically).

If i search for the expression "released from all quarantines" it will still report to many messages.



The background is that we want to see if our (and the antispam) filters are correct or if there are to many manual releases on special filters.

I wonder if noone else has got the same question.



Kind regards

Andreas

[dmccabej]

Hello,

As Marc mentioned, there is no currently nothing prebuilt to complete this type of task, and you would need to gather/push the logs somewhere off-box to perform more complex queries. 

Thanks!

-Dennis M.

[marc.luescherFRE]

There is no out of the box report for this use case.

You will need to import the mail logs into a SIEM or log analysis tool to make more complex queries.

Regards

Marc

[Siebe]

Is the email being delivered to Exchange ? Maybe you can perform a search from that end. On IronPort go to: Mail Policies - incoming Mail Policies - Anti-Spam settings. Is "Add Text to Subject" configured. You can select Prepend and then add the text: [Suspected SPAM]. When the message is released it still has this subject. You could perform a search in Exchange for [Suspected SPAM].