Filtering an Advanced ECA search

Last published : Jun 07, 2026
To filter an Advanced ECA search
  1. On the Investigations tab, selectManaged Accounts.
  2. Select the already existing Advanced ECA search that you want to filter.
The search opens in the right pane.
  1. Expand Search Criteria to view the criteria based on which this Advanced ECA search is created. You cannot edit the search criteria of Advanced ECA search.
  2. Expand Filters, and click** Apply** to view the total number of records captured while saving this Advanced ECA search.
    Note: ClickingApplyis a mandatory action to view correct number of filtered records in the Advanced ECA search. In a single Advanced ECA search, the application can save maximum 1000000 records each for emails, collaboration messages, and files. Out of 1000000 records, the application displays only 50000 email records to users based on the filters applied. Users need to set the filter criteria carefully to filter desired archived items. If number of filtered item messages is greater than 50000, the application displays the following message: Too many items match the filter. The review set is capped at 50000 items.
  3. Under Filters , select or clear corresponding filter options.
The Filters section provides the following filter options that you can select or clear based on the idea of record analysis. To reset all filter options simultaneously, clickClear. You cannot save the filter criteria. After you clear the filter options, you need to set the filter options again.
Filter Name Action
Subject Specify any word or a term that is used in the Subject statement of a Search item.
Author Specify the author of that email or message.
FormatType Select this option to filter records based on format type.
SourceType Select one or more required source types to filter items collected from them.
For more information, See Performing Advanced Search and Query Search .
Direction Selects items that are traveling in a certain direction (incoming, outgoing, or interoffice communications).
MessageDate Specify the duration of the records you want to search. You can customize the date range.
PolicyAction Selects items by the policy action with which your policy management software has tagged them. This action can be one of the following\:
- Inclusion (demands or suggests capture)
- Exclusion (precludes capture or advocates non-capture)
- No Action (the item is subject to normal random sampling)
PolicyName Specify the specific policy with which your policy management software has tagged the items you want to filter.
SentimentScore Classifies and displays the records based on their sentiment score. Click the displayed options to view those specific records.
TagValue Select the specific tags to filter items to which these tags are applied.
Label Select the specific labels to filter items to which these labels are applied.
HasAttachments Specify if you want to filter records that have or have not the attachments to them.
  1. Click Apply to view the filtered records from the selected Advanced ECA search.