Held Messages

Messages that have been intercepted by your security policy are retained in Message Areas by Secure Email Gateway. These messages are referred to as Held Messages.

From the Messages menu, you can find, analyze, and view held messages. This is useful if you want to locate individual held messages. The Messages menu also enables you to release, delete, and process individual manages directly. In addition, you can also create and configure batch operations that can process multiple held messages in a single operation.

Tell me about...

• Message Areas

  Message areas hold messages that have been detected by Secure Email Gateway using policy rules. Policy rules can determine the reason why a message must be held, and use disposal actions to hold the message in a corresponding message area.

  Administrators can view and analyze messages in a message area and can choose how to process the message.

• Supplied Message Areas

  Message areas are created as a result of Disposal Actions. There are a number of pre-configured message areas, which are supplied with the Secure Email Gateway starter policy. These message areas provide basic message holding:

  Supplied Message Area	Contains...
  Confidential	Messages containing confidential material.
  Encrypted	Encrypted messages.
  Encryption or decryption failures	Messages that have failed to be encrypted or decrypted.
  Executables	Messages containing executables.
  Large Images	Messages containing images that exceed a configured size threshold.
  Message Processing Failure	Messages with one or more components that the Policy Engine could not identify during content analysis. For example, a message that is not compliant with standards, or a message containing corrupted data files.
  Misrouted Messages	Messages that follow the route labeled For all email that does not match another route. These messages are managed by a disposal action that retains them in the Misrouted Messages area.
  Multimedia	Messages that contain selected multimedia types.
  Oversize	Oversize messages.
  Problem Messages	Typically, problem messages that caused an internal failure during content analysis. This can include messages that have been deliberately malformed for use in denial-of-service attacks.   If you are in any doubt about messages retained by the Problem Messages area, contact your Clearswift technical support provider.
  Profanity	Messages containing detected profanities as defined by managed lists.
  Spam	Messages containing suspected spam.
  Suspected Malware	Messages containing suspected malware.
  Unknown Binary	Messages containing unrecognized (non-empty) binary files.
  Virus	Messages containing a virus.

  You cannot delete the Problem Messages or the Message Processing Failure message areas. These are required by the system.

• Messages on Peered Gateways

  You can manage messages from a local Gateway across a group of up to eight peers. Using the Messages menu, you can view, analyze, process, and manage messages on any of your peered Gateways.

How do I...

• Find held messages?

  1. Navigate to Messages > Find Held Messages. The Find Held Messages page is displayed.

  2. Enter your search criteria.

     Search Criteria	Description
     Sender	The email address of the sender.
     Recipients	The email address of the recipient(s).
     Subject	The subject of the message.
     Area	The specific message area you want to search. Select Any to search all available message areas.
     Reason	The reason the Gateway has held the message. For example, the name of a virus.
     Processed	The period in which the Gateway has processed the message. Select from the drop-down menu.
     Expiry Date	The time when the message expires. Select from the drop-down menu.
     Peers	The Peer Gateway(s) in your group. Select the peers you want to include in the search.

     You can search for a fragment, or part of a word, in any of the text fields. For example, searching for @company.org in the Sender field returns all held messages from senders using the company.org domain. Similarly, searching for conf in the Subject field returns message subject lines that include the words confidential, conference, and confirmation.

  3. Click Apply. The search results are displayed, showing all held messages that match your criteria.

  4. After performing a search for held messages, you can:

     • Select and view a held message.
     • Select and process a held message.
     • Click Reset Filter to refresh the search.
     • Click Click here to change these settings to perform a new search.
     • Click Add batch to perform a batch operation on the search results. The Add Batch Operation dialog box is displayed.

• View and manage a held message?

  1. Navigate to Messages > Find Held Messages. Use the Find Held Messages page to search for held messages.

     If you know the message area to which your message has been sent, you can also open it directly from the Held Messages table under the Messages menu. Select the message area you require. The Message Filter displays the details of the message area, listing all messages that are currently retained.

  2. Select the message you want to view using the check boxes adjacent to the search results. The viewing and processing options are displayed.
  3. Click View. The View Message page is displayed.

  You can use the View Message page to examine elements of the message. Each of the tabs displays information related to the selected message.

  You can also use the toolbar options to process and manage the message.

• Configure a scheduled message release?

  You can release messages from a held message area according to a timed schedule. For more information, see Schedule message release.

• Create or modify a Message Area?

  Message areas are created automatically when you define Disposal Actions as part of your content security policy. Disposal actions determine what happens to messages when they are intercepted. For example, the Confidential disposal action reroutes all intercepted messages to the Confidential message area.

  In order to create a new message area, you must create a new disposal action.

  To modify a message area, see Disposal Actions for more information.