Report missed spam/phishing (false negative) in IronPort

[BrianBrehart22083]

Greetings,

Recently we were hit with a small spam/phishing outbreak that affected (as far as I and IronPort can tell) about 14 users. None of these users have the original e-mail, so I don't have anything to attach when I send an e-mail to spam@access.ironport.com or phish@access.ironport.com. Does anyone know of a way to submit from the IronPort utility itself? 

Cheers

[meppler1]

Greetings

as the ESA does not store the messages, there is no way to get a submission done without the original message out of the end users mailbox.

Best regards
Martin