When Central Management System Peer Distributed Correlation is enabled, a globe icon in the URL column on the Email Security — Server: Email Alerts page indicates that a user clicked a malicious URL that was detected by a Network Security appliance that was managed by Central Management System peers.
The Email Alerts page lists the results, grouped by recipient, of the correlated email events detected by the Email Security — Server appliance in one network with malicious URLs detected by the Network Security appliance that was managed by a Central Management System peer in a different network.