After configuring Email Security with Microsoft Office 365, a scan is performed to provide visibility into email threats missed by previous email security tools. The scan checks the last 90 days of historical email data across all synced Microsoft 365 inboxes.
Note: This scan is informational only and does not remediate any threats found. You can review the information on this page and manually investigate threats on the user mailboxes if they're still present.
To view the scan results, go to Manage > Email Security, then Email Incidents > Scan-back incidents.
CAUTION - The results on this page are stored and displayed for 60 days after the scan is completed. Afterwards, the data is automatically deleted and the tab is removed from the Incidents log page. Be sure to export the data with the Export CSV button before the data is removed from the page.
Scan-back incidents columns
The following columns are available on the Scan-back incidents screen:
- Incident ID: An ID number associated with the incident. Click the Incident ID for more details.
- Subject: Email subject.
- Sender: Sender email address.
- Recipient Email: User who received the email.
- Recipient Name: User's name.
- Created At: Time the incident was added to the Scan-back incidents page.
- Associated emails: Number of email addresses tied to the same attack or campaign.
- Associated links: Number of links found in the email.
Click Add / Remove Columns to choose which columns to display.
Scan-back details
Clicking on an Incident ID brings up a slideout with additional details on the email incident:
- Categorization: Current categorization of the email.
- Confidence Score: How confident the AI engine feels in the categorization.
- Reported on: Time the first email was reported.
- Email Body: Message body contents of the email.
- Headers: Hidden metadata attached to every email.
- Links: URLs present in the email.
- Attachments: Email attachments.
- Sender Relationship Assessment: Diagram verifying where the email originated from.
- Sender Fingerprints: Technical indicators like the sending domain, mail server, and return path analysis.
- Categorization confidence: Visual dial indicating how confident the community was in the categorization.
- Associated Emails: Other email addresses targeted in the same attack or campaign.
Return to Email Security guide.