Creating and running application-level searches

Last published : Oct 15, 2026
To understand the prerequisites, see About application-level searches.
To create and run an application-level search
  1. In the left navigation pane, click Application.
  2. In the Searches tab, click New Search.
The Create New Search dialog box appears. If the sections in this dialog box are in the collapsed state, expand them to view the corresponding fields.
  1. In the Search Type section, specify the relevant information in the following fields.
    The New Search dialog box appears. This section identifies the search and specifies when it runs.
    Field Description
    Search In Displays the departments in which the search will run. In the case of an application-wide search, by default this value is <All Departments>.
    Based on search Select an existing search as the basis on which you can set the criteria for the new search.
    Search Type Select the type of search as needed.
    - Select the Scheduled option to specify a period during which the search is to run. Specify the scheduler run start date and end date.
    - Select the Guaranteed Sample option to run the search at the selected sampling time, which is 1:00 A.M. by default. Select the Enabled check box to enable the search.
    Name Type a name for the search.
    Include items already in review Select this check box to specify whether the search results can include the items you previously captured and added to this department's review set. This option does not apply to the items you previously included in the review sets for other departments.
    For an immediate search or scheduled search, you can select this box to ensure that the results include the items that may already be in review from other searches.
    Search Schedule Select a required search schedule based on which the search runs at set times or set intervals.
    Schedule run start date Select a date on which the search needs to run.
    Schedule run end date Select a date on which the search needs to stop running.
  2. In the Sampling section, specify the relevant information in the following fields.
    This section lets you sample the search results and add a random selection of items to the review set.
    Field Description
    Sampling percentage Specify the percentage of search results to include in the review set. You can specify fractional values, such as 10.25.
    You cannot change the sampling percentage if the owner of the department has locked this setting in the department properties.
    Set minimum items per author Specify the minimum number of items per author to include in the review set. If there are no items for an author in the search results, none can be included in the sample.
    Note: As the authors can be from outside the selected department, searches may return more results.
    Set absolute item limit Specify an upper limit on the total number of search results to add to the review set. This option takes precedence over any value that you set in the Sampling percentage field.
  3. In the Date range section, specify the relevant information in the respective fields.
    This section lets you search for items according to when they were sent or received.
    Field Description
    Specific date range Specify the date and time duration to search items that were sent or received during the selected period.
    Today / Yesterday / Last 7 days / Last 14 days / Last 28 days The date ranges are relative to when the search runs, which is today in the case of an immediate search.
    You may find these options useful when creating a scheduled recurrent search that runs once every day, week, two weeks, or four weeks. For example, if the search runs once a week, select Last 7 days to limit the range to the days since the search last ran.
    Since search last ran For a scheduled search only, lets you search the new items that have arrived since the last time you ran the search. This option is similar to options such as Today and Yesterday. However, it lets you set an explicit start date for the first run of the search. By default, this option searches from the date of the last run (or the start date for the first search) to the current day minus 1 (that is, up to yesterday).
  4. In the Authors and recipients section, specify the relevant information in the following fields.
    This section targets the departments for the search and the direction of the items to search. Any departments that you have organized into partitions can only search items to and from departments in the same partition.
    Field Description
    Message Route Specify the departments you wish to search as well as the direction of the items you wish to search. Search for the items that are to or from the selected departments, and for the items that have traveled between the selected departments and other departments.
    You can search for the items that follow the following message route:
    - Between "the specified department" and:
        - Custom addresses / domains
        - Any department within the organization
        - Department outside the organization
        - Department internal AND/OR External to organization
    - To "the specified department" from:
        - Custom addresses / domains
        - Any department within the organization
        - Department outside the organization
        - Department internal AND/OR External to organization
    - From "the specified department" to:
        - Custom addresses / domains
        - Any department within the organization
        - Department outside the organization
        - Department internal AND/OR External to organization
    Any of / All of To search within department tags, select a department. To search within the To/From fields, select only the employees.
    You can expand the department tag to select monitored employees. If there are many employees in the department, click the search icon in front of the department tag to open a new window where you can search and select monitored employees.
    Use inheritance, automatically include new departments Specify whether to apply the search to the subdepartments of the selected departments.
    By default, any new departments that are subdepartments of others automatically inherit any active, recurring searches that are applied to those departments. This also applies to existing departments that you move under departments with recurring searches.
    Department tree Specify the departments you want to include in the search. Click the arrows to the left of the department names to expand them and view the nested departments.
    Freeform email addresses / domains This field is available for all possible message routes. Type one or more email addresses and domains.
    Type each address or domain on a separate line to search for items where the From, To, CC, or BCC fields contain any of the specified addresses or domains. Type all the addresses and domains on a single line to search for items in which they are all present.
    Prefix an address or domain with a minus sign (-) to exclude it from the search. To exclude multiple addresses or domains, type them all on a single line.
    Note: You can use Freeform email addresses / domains to search for email addresses associated with user accounts that now use the discontinued domain.
    To search for previously monitored employees, use the department internal AND/OR External to organization message route, and then use the Freeform email addresses / domains option to provide email addresses or domains.
  5. In the Search terms section, specify the relevant information in the following fields.
    This section specifies the words or phrases for which the application should search in the subject lines of items and their bodies. By default, when you search for words in both the subject of an item and its content, the application finds those items that meet one or both criteria. However, it is possible to set up the application so that only those items that meet both criteria are found.
    Field Description
    Subject Type the keywords or phrases to be searched in the review items either in their subject lines or in the file names of their attachments. Press Enter to separate keywords and phrases from each other.
    Alternatively, click Hotwords to select hotword sets and keywords.
    If the department has a parent department, you can select hotwords/hotword sets from the current department and its parent department and global hotwords/hotword sets. Hotwords/hotword sets from any of the closed parent departments are not available for selection. The application searches hotwords/hotword sets from both departments and its parent department and global hotwords/hotword sets.
    Note:
    - Use an asterisk (*) wildcard to represent zero or more characters in your search. Use a question mark (?) wildcard to represent any single character. A wildcard search always finds items that match your search criteria and that were archived in Arctera Surveillance.
    - Use a minus sign (-) to indicate that you want to exclude from the search results any items that contain the specified word or phrase. For example, to find items that contain the word Agent, but do not contain the word Cost, specify: Agent AND -"Cost".
    - A search term cannot comprise an excluded word or phrase only. When you specify such words or phrases, you must also specify a positive word or phrase that you want to appear in the search results.
    - A search term cannot start with any of the following characters on any line: =, +, -, @. For example, Agent AND -Cost is a valid search term, but -Cost Agent is not.
    - Arctera Surveillance ignores any non-alphanumeric characters in the search term, except for those that have special significance, such as the plus sign, minus sign, and question mark. For example, a search for the term US@100 may find instances not only of US@100 but also of US 100 and US$100. Including non-alphanumeric characters in the search term may therefore return more results than you expect.
    Content Specify the keywords or phrases to be searched in the content of review items.
    Alternatively, click Hotwords to select hotword sets and keywords.
  6. In the Attachments section, specify the relevant information in the respective fields.
    This section lets you search for items of a certain size and type or that have the specified retention category.
    Field Description
    Number Specify the required number of attachments.
    You can search for items with a specific number and type of attachments. The default option, Does not matter, means that the item can have zero or more attachments.
    All other options require you to specify one or two values that define the required number of attachments:
    - Equals: Requires a specific number of attachments.
    - Between: Requires the number of attachments to be within the specified range.
    - Less than: Requires the number of attachments to be less than the specified value.
    - Greater than: Requires the number of attachments to be greater than the specified value.
    File extensions Specify the file name extensions of particular types of attachments for which to search. Separate the extensions with space characters.
    For example, type .htm .xls to search for items with HTML or Microsoft Excel file attachments.
  7. In the Miscellaneous section, specify the relevant information in the respective fields.
    This section lets you search for items of a certain size and type or that have the specified retention category.
    Field Description
    Message size Specify the size, in kilobytes, of each item to search for, as reported by the message store (Exchange, Domino, and so on). The message size includes the size of any attachments.
    The following options are available:
    - Does not matter: Includes items of any size (0 KB or greater).
    - Equals: Requires the message size to match the specified value.
    - Between: Requires the message size to be within the specified range.
    - Less than: Requires the message size to be less than the specified value.
    - Greater than: Requires the message size to be greater than the specified value.
    Message type Displays a list of configured and enabled content sources for the customer.
    Select the All content sources check box to search messages from all content source types simultaneously. When this option is selected, the remaining options are disabled.
    To search specific message types, clear the All content sources check box, and then select one or more content sources from the available list.
    Trash option Select the appropriate option to search for items in the trash:
    - Ignore trash: Does not search for items in the trash.
    - Include trash: Searches for items in the trash along with items that match the other specified criteria.
    - Trash only: Searches only for items in the trash.
  8. In the Tags section, specify the relevant information in the respective fields.
    This section lets you search for items according to the tags with which any additional policy management software has classified them.
    Field Description
    Filter Select any of the following options to search for items that match certain classification policies. The available policy types are:
    - Inclusions only: Includes items that your policy management software has classified for inclusion in the review set because they may contain the most serious offenses, such as swearing, racism, or insider trading.
    - Ignore inclusions: Ignores items that Arctera Classification has classified for inclusion in the review set that may contain the most serious offenses, such as swearing, racism, or insider trading.
    - Exclusions only: Includes spam items and newsletters that your policy management software has classified for exclusion from the review set.
    - Ignore exclusions: Ignores spam items and newsletters that your policy management software has classified for exclusion from the review set.
    - Categories only: Includes categorized items that exhibit certain characteristics, such as containing Spanish text. This type of policy provides no information on whether an item should be included in or excluded from the review set.
    - Ignore inclusions and exclusions: Ignores both inclusion and exclusion items.
    - Custom: Select this option and specify one or more policy names. Separate multiple tag names with commas, for example: CustomTag1,CustomTag2.
    - All: Includes all tags.
    Note: Arctera Classification is required to classify items based on their content and metadata. Implementing Arctera Classification requires additional charges.
    Name Select tag names. Separate multiple tag names with commas, for example: CustomTag1,CustomTag2.
  9. In the Intelligent Review section, choose options for the learning engine in Arctera Surveillance.
    This engine allows Arctera Surveillance to search for items intelligently, based on the actions that reviewers have taken on earlier items. For example, after a reviewer has marked a spam message or out-of-office reply as irrelevant then, when Arctera Surveillance detects other items that have similar characteristics, it can handle them in the same way.
    Note: Searches that use the intelligent review feature may take slightly longer to complete than those that do not use this feature.
    Searches, by default, consider metadata and content of items to determine the relevance. However, if search results contain items that are older than 30 days, only metadata is considered to determine the relevance.
    The options for Learning behavior are as follows:
    Field Description
    None Arctera Surveillance searches for items in the normal way, without implementing Intelligent Review. This is the default option.
    Search and prioritize Arctera Surveillance searches for both relevant and irrelevant items without favoring one over the other. For example, if your chosen Sampling percentage requires capturing and reviewing 10% of items, Arctera Surveillance captures 10% of the items, although a substantial number of them may be irrelevant.
    With this option, Arctera Surveillance assigns the items a status of either Unreviewed (Relevant) or Unreviewed (Irrelevant) as it adds them to the review set. When reviewing the items in the Review pane, you can filter them by their Unreviewed status to distinguish between relevant and irrelevant items.
    Search and then sample ONLY relevant content Arctera Surveillance searches all items and captures only the relevant items until the required percentage is reached. For example, if your chosen Sampling percentage requires capturing and reviewing 10% of items, Arctera Surveillance captures 10% of the items that are considered relevant.
    If there are too few relevant items to meet the selected sampling percentage, Arctera Surveillance does not supplement them with irrelevant items. This behavior differs from the equivalent option, Sample exact percentage of ONLY relevant content, in the Department Properties pane.
  10. Click Save.
    Note: When more than 500 departments are selected in an application search, the search gets disabled for performance reason. Navigate to Application > Searches > Edit to confirm departments, and then enable the search.
Related information
Managing application-level searches