You can view all of the submissions related to an email processed by the Email Security - Server appliance. This allows you to quickly trace the URLs, objects, and archives that were analyzed and their verdicts, whether the verdicts are malicious or non-malicious. This information can help you identify false positives and false negatives.
Note
You can also search for all emails containing a specific URL, object, archive, and so on. For details, see Viewing and exporting the results of processed emails.
Log in to the Email Security — Server CLI.
Go to CLI enable mode:
hostname > enable
Obtain the queue ID:
hostname # show submission id <submission ID>
Locate the
Queue IDfield in the command output.View submissions related to the email:
hostname # show email-analysis queue-id <queue ID>
where
queue IDis the value you obtained in the previous step.
Example
The following example shows the submissions related to the email associated with the specified queue ID.
hostname # show email-analysis queue-id 4B2DXXXXXXXXXXXX Queue ID : 4B2DXXXXXXXXXXXX Message ID : 010001XXXXXXXXXX-c9XXXXXX-05XX-... Sender : Acme News <newsletters@allthingsacme.com> Receiver : joed@mailbox.xx.com Subject : Acme for You Start Time : 2020-07-08 22:16:21 End Time : 1010-07-08 22:16:47 Result : Malicious - Quarantined Total URLs / Attachments : 69 Submission Details Id : 25 Object Name : http://spearphish.xyz.com/login_user.php Status : Malicious ID : 26 Object Name : diff_url.pdf Status : Non-malicious ID : 23 Object Name : test.doc Status : Non-malicious ID : 24 Object Name : http://news.malware.com/1/d4gls9dajgldsRc Stats : Malicious ...