When an Email Security - Server appliance receives a single email message containing multiple threat elements, such as attachments or URLs, the Email Security - Server appliance generates a separate alert for each threat element. You can use the information included in the Message ID column to see which alerts are generated from the same email message.
Alerts generated from the same email message will have the same information in the Message ID column and they will usually be grouped together on the Alerts page. In case some alerts are not grouped together, you can sort the alerts by Message ID to group together all of the alerts generated from a single email message. Customers can also use the Message ID filter to view only the alerts generated from a single email message.