Creating a new search

Last published : Jun 29, 2026
You can search the content of archive accounts from the Investigations tab, using Advanced Search and Query Search.
To create a new search:
  1. Select the Investigations tab, and then select the node where you want to perform the new search:
    • To search your own mailbox, select My Mailbox > Mailbox, or select My Mailbox > New Search.
    • To search one or more of your managed accounts, select Managed Accounts > New Search.
    • To search a single managed account, select Managed Accounts > Accounts, and click the required account. The Search pane appears.
  2. To perform advanced search, specify the following inputs in the Advanced Search tab.
    Option Description
    Custodians • Select All to search archives of all of the custodians that are associated with the case.• Select Custom to search archives of the particular custodians.  1. The Manage button appears. Click Manage to open the Add/Remove Custodians.  2. Expand Selected Custodians to view the custodians selected for this search.  3. Expand Manage Custodians and select the custodians required for this search.  4. (Optional) Select Search Between Custodians at the bottom of the pop-up to retrieve emails exchanged exclusively among the selected custodians. For details, See Searching emails exchanged among specific custodians.  5. Click Update to add these selected custodians as a search input. These custodians are listed under the Selected Custodians section.
    Custom Headers Note: The Custom Headers option does not appear if there is no entry for a custom header for a particular group or tenant in database. Custom header does not work independently. You need to use the filter criteria to search the required items.Expand Custom Headers and set the header operator values.• Click + to add new search clauses.• Click - to remove search clauses that are not required.• In the first column, select the required header you want to search for. Based on the data type you have selected, the operator changes. For example, if you have selected the receiver date in header, the operator values can be Between, Before inclusive and After inclusive. For a numeric or integer header value, the operator values can be Is equal to, Less than, and Greater than. If you have selected a string value in header, then the operator will be Contains.• In the second column, select the available operator.• In the third column, specify the text, phrase, or date that you want to search for.
    Filters Expand Filters and set the filter operator values. The operators are explained in a table below.• Select All to match all conditions you have provided.• Select Any to match any of the conditions you have provided.• Click + to add new search clauses, and complete a new row for each clause.• Click - to remove search clauses that are not required.• Searches are not case-sensitive. The search supports phrase search, Boolean operators, proximity search, and wildcard search. See Search syntax for Advanced Search.
    The Filter operators are listed below:
    Drop-down Drop-down Drop-down
    Message Entire Message Contains / Doesn't Contain
    Subject + Body Contains / Doesn't Contain
    Subject Contains / Doesn't Contain
    Body Contains / Doesn't Contain
    Inbound Message (AND) Yes / NoNote: The inbound message direction is decided differently based on the custodian selection:- Upon selecting all custodians, the message direction is determined at the message level. Such message is treated as message-level inbound when it is sent to an internal domain from an external domain, independent of who the custodian is.- Upon selecting specific custodians, the message direction is determined at the custodian level. Such message is treated as custodian-level inbound when it is sent by the selected custodian, regardless of whether the recipient is internal or external.
    Outbound Message (AND) Yes / NoNote: The outbound message direction is decided differently based on the custodian selection:- Upon selecting all custodians, the message direction is determined at the message level. Such message is treated as message-level outbound when it is sent from an internal domain to an external domain, independent of who the custodian is.- Upon selecting specific custodians, the message direction is determined at the custodian level. Such message is treated as custodian-level outbound when it is sent by the selected custodian, regardless of whether the recipient is internal or external.
    Internal Message (AND) Yes / NoNote:- In Advanced Search, this option filters and retrieves only internal messages exchanged within the same organization.- In Query Search, use: Internal:(3) to include or NOT Internal:(3) to exclude
    Date Sent/Modified(AND) Subject + Body Contains / Doesn't Contain
    Is Hidden Yes / No
    IP Header Contains / Doesn't Contain
    Is Equal To Select a date
    Before Select a date
    After Select a date
    Within range Select a date range
    Participants All Senders and Recipients Contains / Doesn't Contain
    Senders Only Contains / Doesn't Contain
    Recipients Only Contains / Doesn't Contain
    To/Cc Contains / Doesn't Contain
    To Contains / Doesn't Contain
    Bcc Contains / Doesn't Contain
    ClassificationNote: This option is available if the Arctera Classification service is enabled for a user. Classified as Contains / Doesn't ContainSelect a classification tag from the drop-down list. The list shows all the classification tags that have been applied to your company's messages in Arctera Unified Platform.To see a tooltip with a classification tag's description, select the classification tag from the drop-down list and then point to the classification tag.
    Sentiment Score Is Equal To / Below (Inc.) / Above (Inc.)
    Attachment Has Attachment Yes / No
    File/Attachment Name Contains / Doesn't Contain
    File Attachment Type Contains / Doesn't ContainSee Searchable attachment types
    Archive DateFilter archived data based on the date when emails, collaboration items, or files were archived. Is Equal To: Finds items archived on a specific date.Before: Finds items archived before a certain date.After: Finds items archived after a certain date.Within Range: Finds items archived between two chosen dates. Select date.Note: Use this filter only for the data archived after January 2021. Data before January 2021 will not appear in filtered results.Tip: If you want to use Query Search instead of Advanced Search, use the Archive Date:term and then build the search criteria.
    Source Type Is: Filters results that match the selected source type(s)Is Not: Excludes results that match the selected source type(s). Select one or more sources as needed.
    DepartmentNote: This option is available if the Arctera Surveillance service is enabled for a user. All Senders & Recipients: Filters data where both the sender and recipient belong to the selected department(s).Senders Only: Filters data where only the sender belongs to the selected department(s).RecipientsOnly:Filters data where only the recipient belongs to the selected department(s). Select Any or All operator and then click Select Department. A dialog box opens where you can choose one or more departments to apply as a filter.imageSelect Any or All operator and then click Select Department.1. Use the Search Departments field to quickly locate a department by name.2. Toggle the Use Inheritance to include child departments of a selected parent department.3. Click Select All on Current Page to select every department visible on the current page. Else, select the required departments individually. The count of selected departments appears in the bottom of the dialog box.4. Click Select to confirm and apply them as a filter.If you want to reset your choices, click Clear Selection. If you want to close the dialog without saving changes, click Cancel.
    Note:
    • In Advanced Search, the search text input functionality is updated. In previous releases, when users were providing multiple text input with space, the default logical operator "AND" was getting applied. From now onwards, the default logical operator "OR" is getting applied to get user records. This operator change from "AND" to "OR" is applied to all kind of searches. If users have previously used spaces while providing the search text inputs, their saved records (saved searches/standard searches/Ongoing searches) will be impacted as the operator is changed from "AND" to "OR".
    • Based on the selected attributes, when you export the search report, the Search Summary and Search Report is generated as shown in the sample image below.
    image
  3. To perform query search, specify the following inputs in the Query Search tab.
    Note: Use the scroll bar to view the lengthy queries.
    Option Description
    Custodians - Select All to search archives of all of the custodians that are associated with the case.- Select Custom to search archives of the particular custodians.1. The Manage button appears. Click Manage to open the Add/Remove Custodians.2. Expand Selected Custodians to view the custodians selected for this search.3. Expand Manage Custodians and select the custodians required for this search.4. (Optional) Select Search Between Custodians at the bottom of the pop-up to retrieve emails exchanged exclusively among the selected custodians. For details, See Searching emails exchanged among specific custodians.5. Click Update to add these selected custodians as a search input. These custodians are listed under the Selected Custodians section.
    Query Search Specify the search query by providing keywords.
Related information

Guidelines for specifying queries

The application supports query searches only if the following necessary conditions are followed. Else, the application displays corresponding errors.
Conditions Examples
Operator-specific conditions The search criteria must be used after the operator and before the query text. Correctsubject:hi OR attachments:testIncorrectsubject:hi OR test
The AND/OR/NOT operators must be written in capital letters. Correctsubject:text1 AND textbody:text2 OR attflag:trueIncorrectsubject:text1 and textbody:text2 or attflag:true
The AND/OR logical operator is missing. CorrectEntireMessage:test AND NOT Entiremessage:hiIncorrectEntireMessage:test NOT Entiremessage:hi
Spaces-specific conditions The extra space(s) between operators is not allowed. Correct(NOT subject: test AND NOT textbody:test)
- The space after bracket is not allowed. Correct(NOT subject: text1)Incorrect( NOTsubject: text1)
- The space before colon is not allowed. Correct(NOT subject: test AND NOT textbody:test)Incorrect(NOT subject: test AND NOT textbody:test)
  1. To search for the Arctera Surveillance item using the Item ID Filter, perform the following steps:
    Note: If you have a Arctera Surveillance subscription and the Show Item ID Filter feature is enabled in the Management Console, you can view the Id icon in the email preview pane as shown in the sample image below:
    Click the Id icon to copy the encrypted Item ID, then select Advanced Filter, expand Item ID Filter, choose Is Equal To, and paste the Item ID into the field as shown in the sample image below.
    image
    Note: When the Item ID Filter is selected, all other filters are cleared to return the exact matching item
  2. Click Search.
  3. (Optional) To create a context of this search, click the InsightAI icon as shown in the sample image below.
    The InsightAI icon is visible only if this service is enabled for your account. Acting as your built-in AI assistant based on Open AI GPT-4.1 Nano model, it delivers faster, smarter, and more reliable answers from both new and saved searches by generating context from emails, collaboration messages, and files.
    You can use the predefined prompts or enter your own prompt (query) to generate context.
    Note: For any support about this service, contact your system administrator.
    image
  4. Click Save Search.
    See Saving searches in Review sets and Research sets.