How to find emails tagged by message direction using Enterprise Vault advanced web search or Discovery Accelerator (DA) search.

Article: 100030493
Last Published: 2023-10-23
Ratings: 1 0
Product(s): Enterprise Vault

Description

Investigative requirements may arise where emails need to be found in searches based on one or more specific message directions.  Enterprise Vault (EV) tags every message that is journal, mailbox or SMTP archived with a direction tag.  This direction tag indicates that the message was Inbound Only, External-Inbound, or External-Outbound.  The determination of the message direction is based on the SMTP domain(s) of the email addresses associated with the Vault Service Account, the account used by the archiving task, the values in the Vault Admin Console | Site Properties | Advanced | List settings from:List of internal SMTP domains value(s), and by the domains specified in the InternalSMTPDomains registry value. 

Note: The default configuration for message direction determination first uses the SMTP domains specified on the account used in the configuration Exchange mailbox (Journal or User) account.  If Exchange archiving is removed from an environment and replaced by SMTP archiving, either the List of internal SMTP domains listing must be updated with a semicolon separated list of internal SMTP domains or the InternalSMTPDomains registry value must be populated for proper message direction determination. Note - If entries exist in both the List of internal SMTP domains listing and the InternalSMTPDomains registry value, all entries will be used.

It is possible to search for messages based on the direction tag using the EV Search feature or Discovery Accelerator (DA) application.  The message direction tags assigned by EV archiving are:

0 = Undetermined - messages that cannot have their direction determined.

1 = Internal Only - messages that are sent from and received by users with SMTP addresses within the SMTP domain or domains that are considered internal to the company.

2 = External-Inbound - messages that are sent from SMTP addresses outside the company's SMTP domain(s) to recipients with SMTP addresses that are internal to the company.

3 = External-Outbound - messages that are sent by users with SMTP addresses within the company's SMTP domain(s) to recipients with no SMTP address or with SMTP addresses that are outside the company's domain(s).

If any archived messages are tagged with the wrong direction, the cause of the incorrect tagging must be corrected and then the messages must be restored and re-archived in order to have the correct direction tag applied.

Using the EV Search feature.

EV Search should be configured to display the message direction prior to searching for any specific message direction as a way of confirming the returned results when multiple or no message directions are specified within search criteria.  To configure EV Search to display the message direction, the following steps should be completed.

1. Open Internet Explorer to the EV Search site for the individual user (i.e., https://evserver/EnterpriseVault/search/shell.aspx)

2. Click on the user's name in the upper right frame.

3. Select the Preferences option.

4. Select the Advanced Search option.

5. Place a check mark in the check box of the Show custom fields option.

6. Click the Done button to save and close the change.

7. Right click on any column header.

8. Click on the Columns option.

9. Click the Customize Columns option.

10. Highlight any entry in the Property Name column that is currently unused (either empty or does not have a check mark in its checkbox).

11. Enter Vault.MsgDirection into the field.

12. Highlight the Column Header entry for the chosen Property Name row.

13. Enter any label for the column that would identify the column as showing the message direction (i.e., MsgDir).

14. Click on the check box to the left of the chosen line to place a check mark in it so that the newly configured column will be displayed.

15. Click the Done button to save the change and close the window.

The results panel will now show the message direction number assigned to each message in the search results.  The direction number should be one of those noted above.

 

To configure the search criteria to search for a specific message direction, the following steps should be completed.

1. If not already open, open Internet Explorer to the EV Search site for the individual user (i.e., https://evserver/EnterpriseVault/search.shell.aspx).

2. Ensure the Show custom fields option is selected as shown in Steps 2 through 6 in the above instructions.

3. Click on the Advanced link in the upper right of the pane. This will cause 2 criteria lines to be displayed with one defaulting to searching the From field and the other defaulting to search the Subject or Content fields.

4. Click the - or + buttons to the right of the criteria lines as needed (- to remove the criteria line, + to add a new criteria line after the current criteria line).

5. In any criteria line, click the drop down arrow to the left of the criteria line label (i.e., From).

6. Select the Custom Text Field option under the Advanced section.

7. Select the appropriate Contains option (i.e. for text field: contains any of, contains all of; for number field: is between, is equal to, is less than, is greater than).

8. Enter the desired message direction into the value field to the right of the Contains field (i.e., Vault.MsgDirection is equal to 1).

9. Click on the search button (contains the magnifying class icon) to run the search.

With the display configured to show the message direction as noted in the steps 1 through 15 above, the search results returned will display the items found by the search and their message direction.

 

Using Discovery Accelerator.

Any message direction can be searched in any combination of directions. Custom attributes can be defined at the application level or within each search using the open fields in the Custom Attributes criteria section.  For an application level search attribute that is available in new searches within all cases, take the following steps.

1. Click the Configuration tab.

2. Click the Search Attributes sub-tab.

3. Click the New button.

4. In the Name: field, enter Vault.MsgDirection

5. In the Display Name: field, enter MsgDirection

6. In the Type: field, select Checkboxes

7. In the Data Type: field, leave String selected

8. In the Column Size: field, enter 5

9. In the Operators: field, select Any

10. In the Values: area

a. Click the New Value button

b. In the Name: field, enter Internal Only

c. In the Value: field, enter "1"

d.  Click the Update link to save the value

e. Click the Value button

f. In the New Name: field, enter External-Inbound

g. In the Value: field, enter "2"

h.  Click the Update link to save the value

i. Click the New Value button

j. In the Name: field, enter External-Outbound

k. In the Value: field, enter "3"

l.  Click the Update link to save the value

11. Click the Save button to save the new attribute

12. Within a new search, enter the appropriate search criteria, then

a. Expand the Miscellaneous section at the bottom of the page

b. In the Custom Attributes portion of the section, click the checkbox(es) for the required message direction(s).

c. Click the Save button to save the search criteria and launch the search if an immediate search.

Notes:

1. No default message direction should be configured in the custom attribute setup, so any new search will run without any message direction selected.  Such a search would return all hits per the search criteria, regardless of  message direction.

2. Once a selection has been made, it can be cleared completely by removing the check from the direction checkbox before the search is saved and submitted.

 

To configure an individual search to look for items by message direction, the following steps should be completed.

1. Configure the initial search criteria (i.e., search Name, Search TypeAutomatically accept search resultsInclude items already in review, Date range, etc.) as needed.

2. Expand the Custom Attributes criteria section.

3. In the first Free form attribute line, enter into the Attribute: field Vault.MsgDirection

4. In the Type: field, click on the drop down arrow and select the String option if needed (the default selection is String).

5. In the Operator: field, select the Any option.  The All option should not be selected as a message can only have 1 message direction specified.

6. In the Value: field, enter the number associated with the message direction desired.

7. Click the Save button to run the search if it is an immediate search or to have the search run on the selected schedule if a scheduled search.

Notes:

1. The Custom Attributes section contains 2 Free form attribute lines.  Only 1 line can contain the Vault.MsgDirection attribute.

2. The Value: field can only contain 1 value.

 

 

Was this content helpful?