About the search attributes

Table: Search attributes lists all the available attributes. For each attribute, the table shows the operators that you can use with the attribute, and describes its purpose.

Table: Search attributes

Attribute

Type

Accepted operators

Description

AttachmentsCount

Numeric

=

>

>=

<

<=

Use AttachmentsCount to add a condition that is based on the number of email attachments.

Author

String

CONTAINS

ANYOF

NOT CONTAINS

NOT ANYOF

Use Author to add a condition that is based on the email's sender.

Enclose full names in double quotation marks ("). You can also type first names, last names, or middle names individually.

Values that correspond to targets (T:), target groups (TG:), custodians (C:), and custodian groups (CG:) must be on a separate line. Prefixes such as T: and TG: must be in upper case.

AuthorOrRecipients

String

CONTAINS

ANYOF

NOT CONTAINS

NOT ANYOF

AuthorOrRecipients is a composite attribute that lets you add a condition that is based on senders and recipients in any of the following attributes:

  • From

  • To

  • CC

  • BCC

Enclose full names in double quotation marks ("). You can also type first names, last names, or middle names individually.

Values that correspond to targets (T:), target groups (TG:), custodians (C:), and custodian groups (CG:) must be on a separate line. Prefixes such as T: and TG: must be in upper case.

BCC

String

CONTAINS

ANYOF

ALLOF

NOT CONTAINS

NOT ALLOF

NOT ANYOF

Use BCC to add a condition that is based on the email's BCC recipients.

Enclose full names in double quotation marks ("). You can also type first names, last names, or middle names individually.

Values that correspond to targets (T:), target groups (TG:), custodians (C:), and custodian groups (CG:) must be on a separate line. Prefixes such as T: and TG: must be in upper case.

CC

String

CONTAINS

ANYOF

ALLOF

NOT CONTAINS

NOT ALLOF

NOT ANYOF

Use CC to add a condition that is based on the email's CC recipients.

Enclose full names in double quotation marks ("). You can also type first names, last names, or middle names individually.

Values that correspond to targets (T:), target groups (TG:), custodians (C:), and custodian groups (CG:) must be on a separate line. Prefixes such as T: and TG: must be in upper case.

Content

String

CONTAINS

ANYOF

ALLOF

NEAR

NOT CONTAINS

NOT ALLOF

NOT ANYOF

Use Content to add a condition that is based on a string in the body of the email, or in the file's content.

Enclose any phrases in double quotation marks ("). For all the accepted operators except NEAR, you can choose to turn search stemming on or off. Discovery Accelerator does not expand distribution lists when you use the NEAR operator, even if you check the option to do so elsewhere in the rule builder.

Values that correspond to targets (T:), target groups (TG:), custodians (C:), and custodian groups (CG:) must be on a separate line. Prefixes such as T: and TG: must be in upper case.

Custom

String

=

NOT =

CONTAINS

ANYOF

ALLOF

NOT CONTAINS

NOT ALLOF

NOT ANYOF

Use Custom to add a condition that is based on any custom attributes created during archiving. Enter the name of the custom attribute before you select an operator and enter the search string.

For example:

Custom.Symantec.MyAttribute CONTAINS "Symantec"

Enclose phrases in double quotation marks ("). If you select the ANYOF or NOT ANYOF operator, you can separate multiple values with commas.

Values that correspond to targets (T:), target groups (TG:), custodians (C:), and custodian groups (CG:) must be on a separate line. Prefixes such as T: and TG: must be in upper case.

Direction

List

=

ANYOF

NOT =

NOT ANYOF

Use Direction to add a condition that is based on the direction of the email. Acceptable values are:

  • Internal

  • External Inbound

  • External Outbound

  • Not Specified

FileExtension

String

ANYOF

CONTAINS

NOT ANYOF

NOT CONTAINS

Use FileExtension to add a condition that is based on email extension type and file types. Enter multiple file types as a list. For example:

DOC PDF MSG

Enclose phrases in double quotation marks ("). If you select the ANYOF or NOT ANYOF operator, you can separate multiple values with commas.

Importance

List

=

ANYOF

NOT =

NOT ANYOF

Use Importance to add a condition that is based on the email's importance setting. Acceptable values are:

  • Low

  • Normal

  • High

MailDate

Date

=

>

>=

<

<=

BETWEEN

NOT BETWEEN

Use MailDate to add a condition that is based on the date the email was sent, and on the modified date of email's attachments.

When you use the BETWEEN and the NOT BETWEEN operators, you must specify start and end dates.

MessageClass

String

ANYOF

CONTAINS

NOT ANYOF

NOT CONTAINS

Use MessageClass to add a condition that is based on the email's MAPI message class setting. For example:

IPM.Note.

Enclose phrases in double quotation marks ("). If you select the ANYOF or NOT ANYOF operator, you can separate multiple values with commas.

MessageType

List

=

ANYOF

NOT =

NOT ANYOF

Use MessageType to add a condition that is based on the email's type. Acceptable values are:

  • Exchange Mail

  • Domino Mail

  • SMTP Mail

  • File

  • Instant Messaging

  • Bloomberg

  • Fax

ModifiedDate

Date

=

>

>=

<

<=

BETWEEN

NOT BETWEEN

Use to ModifiedDate to add a condition that is based on the date the email or file was last modified.

When you use the BETWEEN and the NOT BETWEEN operators, you must specify start and end dates.

OriginalLocation

String

ANYOF

CONTAINS

NOT ANYOF

NOT CONTAINS

Use OriginalLocation to add a condition that is based on the original location of the email or file. For example:

  • Inbox

  • Sent items

  • \\server\share\Sales

Enclose phrases in double quotation marks ("). If you select the ANYOF or NOT ANYOF operator, you can separate multiple values with commas.

Recipients

String

CONTAINS

ANYOF

NOT CONTAINS

NOT ANYOF

Recipients is a composite attribute that lets you add a condition that is based on recipients in any of the following attributes:

  • To

  • CC

  • BCC

Values that correspond to targets (T:), target groups (TG:), custodians (C:), and custodian groups (CG:) must be on a separate line. Prefixes such as T: and TG: must be in upper case.

RetentionCategoryDisplayName

String

CONTAINS

NOT CONTAINS

Use RetentionCategoryDisplayName to add a condition that is based on the retention categories under which the item was archived. For example:

General retention category

RetentionExpiryDate

Date

=

>

>=

<

<=

BETWEEN

NOT BETWEEN

Use RetentionExpiryDate to add a condition that is based on the date the email or file is due to expire. The retention category under which the item was archived determines the expiry date.

When you use the BETWEEN and the NOT BETWEEN operators, you must specify start and end dates.

Sensitivity

List

=

ANYOF

NOT =

Use Sensitivity to add a condition that is based on the sensitivity of the email. Acceptable values are:

  • Normal

  • Personal

  • Private

  • Confidential

Size

Numeric

=

>

>=

<

<=

Use Size to add a condition that is based on the size of the email or file.

Subject

String

CONTAINS

ALLOF

ANYOF

NEAR

NOT CONTAINS

NOT ALLOF

NOT ANYOF

Use Subject to add a condition that is based on strings in the email's subject, and in file names.

Enclose any phrases in double quotation marks ("). For all the accepted operators except NEAR, you can choose to turn search stemming on or off. Discovery Accelerator does not expand distribution lists when you use the NEAR operator, even if you check the option to do so elsewhere in the rule builder.

Values that correspond to targets (T:), target groups (TG:), custodians (C:), and custodian groups (CG:) must be on a separate line. Prefixes such as T: and TG: must be in upper case.

SubjectOrContent

String

CONTAINS

ALLOF

ANYOF

NEAR

NOT CONTAINS

NOT ALLOF

NOT ANYOF

SubjectOrContent is a composite attribute that lets you add a condition that is based on strings in either of the following attributes:

  • Subject

  • Body

This attribute is also used to match using strings in a file's name or content.

Enclose any phrases in double quotation marks ("). For all the accepted operators except NEAR, you can choose to turn search stemming on or off. Discovery Accelerator does not expand distribution lists when you use the NEAR operator, even if you check the option to do so elsewhere in the rule builder.

Values that correspond to targets (T:), target groups (TG:), custodians (C:), and custodian groups (CG:) must be on a separate line. Prefixes such as T: and TG: must be in upper case.

To

String

CONTAINS

ANYOF

ALLOF

NOT CONTAINS

NOT ALLOF

NOT ANYOF

Use To to add a condition that is based on the email's recipients.

Enclose full names in double quotation marks ("). You can also type first names, last names, or middle names individually.

Values that correspond to targets (T:), target groups (TG:), custodians (C:), and custodian groups (CG:) must be on a separate line. Prefixes such as T: and TG: must be in upper case.

More Information

About analytics rules

Creating analytics rules

Changing the priority levels of marking rules

About tagging rules

Manually editing queries

About the operators

Guidelines on using the NEAR operator condition in Discovery Accelerator rules