for Google Workspace / for Microsoft 365
We are creating an account with archive search restrictions.
You can specify the search period and target addresses/domains, but what can you do with "Advanced Search Control"?
The method for describing advanced search queries is as follows. (For how to create a search control account, please refer here)
We also provide examples of "Advanced Search Control" settings that are frequently inquired about, so please refer to them as well.
○ Available Items and Operators
・Items
From: from
Envelope From: mail_from
To: to
Cc: cc
Envelope To: rcpt_to
Attachment: file
Keyword: body
Subject: subject
・Operators
AND (specify multiple conditions with AND), OR (specify multiple conditions with OR), NOT (negate a single condition)
NE (negation), ALL (include all), IN (include any)
○ Example 1 Single Condition
(operator (item "optional information"))
○ Example 2 Multiple Conditions
(operator
(operator (item "optional information"))
(operator (item "optional information"))
)
● Frequently Inquired Setting Examples
■ Example 1
・Requirement
Only emails with attachments should be the search target
・Search Query
(file "true")
■ Example 2
・Requirement
taro@hde.co.jp, jiro@hde.co.jp, sabu@hde.co.jp are executives and should be excluded from the search target
・Search Query
(NOT
(OR
(rcpt_to (IN "taro@hde.co.jp" "jiro@hde.co.jp" "sabu@hde.co.jp"))
(to (IN "taro@hde.co.jp" "jiro@hde.co.jp" "sabu@hde.co.jp"))
(cc (IN "taro@hde.co.jp" "jiro@hde.co.jp" "sabu@hde.co.jp"))
(from (IN "taro@hde.co.jp" "jiro@hde.co.jp" "sabu@hde.co.jp"))
(mail_from (IN "taro@hde.co.jp" "jiro@hde.co.jp" "sabu@hde.co.jp"))))
■ Example 3
・Requirement
Only emails exchanged between user@hde.co.jp and external parties should be searchable
・Search Query
(OR (AND (rcpt_to "user@hde.co.jp") (mail_from (NE "@hde.co.jp")))
(AND (mail_from "user@hde.co.jp") (rcpt_to (NE "@hde.co.jp"))))
■ Example 4
・Requirement
Only emails with attachments exchanged between user@hde.co.jp and external parties should be searchable
・Search Query
(AND (file "true")
(OR (AND (rcpt_to "user@hde.co.jp") (mail_from (NE "@hde.co.jp")))
(AND (mail_from "user@hde.co.jp") (rcpt_to (NE "@hde.co.jp")))))
■ Example 5 ・Requirement Only emails containing specific keywords should be searchable
・Search Query
- Single keyword
(body "desired keyword")
- Multiple keywords ※Specify with OR
(body (IN "desired keyword1" "desired keyword2" "desired keyword3"))
【Notes】
If the search conditions become complex, the response of the search results will be slow. Please execute with as simple conditions as possible.
If you have any other requirements you would like to set, please contact support.