| #

## Mailbox Search Options

ScanMail provides multiple search options to narrow the scope of mailbox searches. Properly configured mailbox searches reduce the usage of system resources and return only relevant search results.

| ##### Tip Trend Micro recommends performing an estimated search before performing Search Now or Search Later. Copying large amounts of data to the discovery mailbox requires more system resources and could result in reduced performance.

Configure the following search options to streamline mailbox search matching.

#### Mailbox Search Options

Option | Description
--- | ---
Keywords | ScanMail searches for the keywords or phrases that the administrator specifies. Use logical operators, parentheses, double quotation marks, wildcards, AQS expressions (for Exchange 2010), or KQL expressions (for Exchange 2013 and Exchange 2016) to narrow the search parameters. For details on searching for keywords, see Syntax Used for Keyword Strings.
| ##### Note The maximum allowable character length of the Keywords field is 8192.
Mailboxes | Administrators may choose to search all mailboxes in the Exchange environment or choose specific users or distribution groups.
| ##### Note Trend Micro recommends performing mailbox searches on a limited number of users or distribution groups. Copying large amounts of data to the discovery mailbox requires more system resources and could result in reduced performance.
To select Specific user or distribution group members' mailboxes: Type a search string in the text box to find the available users, distribution groups, or databases and click Search. Select the accounts or databases to search in the available list and click Add >>. Alternatively, administrators can import pre-existing lists from properly formatted `.txt` files.
| ##### Note The maximum allowable number of email addresses to search is 500. When importing a file, ScanMail only adds addresses to the Selected Mailbox(es) list until the list contains 500 addresses.
Mailbox Components | ScanMail can search all mailbox components in the Exchange environment or administrators may choose to scan only specific components. When choosing specific components, the following options are available: Email Meetings Journal Tasks Contacts Notes Instant messaging conversations
| ##### Note When selecting All mailbox components (including components not listed below), ScanMail includes results found in any component that exists in the Exchange mailbox.
Specific Senders or Recipients | ScanMail searches email messages addressed to the specified recipients or from the specified senders.
| ##### Note ScanMail can search specific senders and recipients using display names, email addresses, or domain names.
Date | Administrators may choose to search all components in the Exchange environment or only those components created within a specified date range.
Discovery Mailbox | Administrators may choose to use a specific discovery mailbox for the search or accept the previously configured default Search & Destroy discovery mailbox.
- Action | ScanMail provides two search actions: Search and compile: All matched results are compiled for review (recommended) Search and delete: All matched results are automatically deleted (not recommended)
  | ##### Note Trend Micro only recommends automatically deleting messages in high security environments.