How to Retrieve Message Source

Question

Please tell me how to obtain the necessary information for investigating HENNGE Email DLP.

Answer

The methods for obtaining each piece of information are as follows.
If you are unsure about which information to obtain, please consult the Customer Success Guide.

* We recommend providing information in .eml file format.
If you provide in other file formats, some email data may not be correctly analyzed in certain investigations.

Google Workspace

Procedure to obtain message source on Gmail screen

・Sent mail

1. Open the relevant email from the sender's [Sent Mail].
2. Click [⋮ (More menu)] in the upper right corner of the screen, then click [Download message].
3. Associate the saved .eml file.

・Received mail

1. Open the relevant email from the recipient's [Inbox].
2. Click [⋮ (More menu)] in the upper right corner of the screen, then click [Download message].
3. Associate the saved .eml file.

Procedure to obtain Google Workspace audit log information

Refer to the following article in Google Workspace Admin Help to search for the relevant email delivery status, capture the details of the search results on the screen, and associate them.
Search for email logs (External link)

Microsoft 365

Procedure to obtain recipient header information in Microsoft 365

1. Open the relevant email from the recipient's "Inbox".
2. Click "⋯ (More actions)" in the upper right corner of the message preview screen, then select "Show" and "View message details".
3. Select all the text on the displayed page, copy it to a text editor, save it, and provide the saved file.

Procedure to check Microsoft 365 email logs

Refer to the following article in Microsoft Support to search for the relevant email delivery status, capture the details of the search results on the screen, and associate them.
Run message tracking and view results (External link)

Procedure to obtain .eml files from OWA (Outlook on the Web)

1. Access OWA from a PC browser.
2. Open Settings (gear icon in the upper right corner of the screen), go to [Layout] - [Message list options], check [Display messages as individual messages], and save.
3. Open the target folder and select the relevant email from the email list.
   ・For sent mail: [Sent Items]
   ・For received mail: [Inbox]
4. Click "⋯ (More actions)" in the message preview screen, then click [Save as] from the menu and save the .eml file.
5. Associate the downloaded file.

Procedure to obtain .eml files from Outlook app

1. Open the Outlook app.
2. Double-click on the target email to open it in a new window.
3. Click [Save as] from the 3-dot menu (...) at the top right of the email body.
   * Do not use the 3-dot menu on the top bar.
4. In the [Save as] window, set the file type to [Email Message] and save.
5. Associate the downloaded .eml file.

Google Workspace / Microsoft 365 Common

Procedure to obtain emails from HENNGE Email Archive

Refer to the following article in the Help Center to download the relevant email and provide it.
How to download searched emails

Procedure for data acquisition through reproduction verification (investigation with HENNGE Email DLP)

* It can be obtained from either the Admin Console or the User Console.

Prepare a pending rule to obtain reproducible data in HENNGE Email DLP in advance.
If you are unsure of the steps, please request setup assistance from the Customer Success Guide.

1. Send an email with reproducible content, match it to the verification rule, and place the email on hold.
2. Select [My Mail] or [Team Mail] in [Hold Tray], then click on the relevant email.
3. Open the relevant email, capture the screen from the subject to the size, and obtain a screen copy.
4. Obtain the .eml file from the download button on the right side of the email title.
5. Delete the email without sending it.
   * It will not be sent to the recipient.
6. Provide the screen copy obtained in step 3) and the .eml file obtained in step 4).