View Message Details

You will often want to view the details of messages sent by untrustworthy senders. Messages sent by specific attack types are represented by the tiles on the left, and messages sent by specific senders are represented by the red circles.

  1. Click one of the attack type tiles and then click View messages to view a list of messages of that attack type, or click one of the red circles to view a list of the messages sent by that sender. The messages are displayed in the search messages results. You can filter to further limit the list.
  2. Click a message to view the Message Details.
Message Details pane

The Message Details page shows information about the message including:

  • Headers and scoring (and the reasons for the scores received)
  • Directionality of the message (Inbound, Outbound, or Internal) if All messages is selected for the Evaluate Messages setting in your organization, see Evaluate Messages)
  • Which policies, if any, the message matched (each policy is a link to the specific policy event)
  • Which CDR events (see Continuous Detection and Response), if any, the message matched (this is a link if you view the message from any place other than its CDR event)
  • Whether the message was enforced (if you have enforcement enabled)

NOTE: Internal and outbound messages do not show the Message Trust Score Reasons section.

Remember that Cloud Email Protection does not track the body of the message.

However, it is often more useful to follow the cross links for Sending Domain and Sending IP Address.

  • The Sending Domain link will answer the question: How often is this domain sending email into my organization, and from how many IP addresses? Are most of the messages legitimate?
  • The Sending IP Address link will answer the question: For what other domains does this IP address send email to my organization? Is the IP reputable? Does it send for a few domains or many?

In the upper right of the Message Details page, you can click the:

  • Message Details link icon () to view of the message details in the main window (with a URL that will link directly to this view).
  • Headers icon () to view all of the headers in the message.
  • Mail icon ( ) so send the message details view to a colleague.
  • Bell icon () to create policy with conditions that match this message. See Create a Policy for more on creating policies.
  • Message Feedback icon () to provide feedback about a message's scoring. See Send Message Feedback for details.