This section explains Enterprise Archive behavior with respect to searching for communications when whitelisting of system headers is enabled. When whitelisting is enabled, users can search for communications containing the headers that are whitelisted and indexed in the system. The procedure to search for communications by the specific list of headers is explained in the following sections.

Important

When new headers are added to the list of whitelisted headers, the search for communications by newly added headers will only involve day-forward data.

Searching for Communications using System Headers

To search for communications using system headers:

Users can perform this search using either List of Terms or Advanced Query search fields.
Specify the whitelisted header in the Must have all of these keywords option under List of Terms, or Advanced Query search fields:

Enable the System checkbox in the Where to Search pane.
If the header is not whitelisted, then a green error banner will be displayed as No Results Found.
If the header being searched is whitelisted, all communications containing these headers will be displayed in the results pane.

System Attribute Search Behavior Change

Users can also search for communications using custom attributes. The following steps explain the change in behavior with regards to using custom attributes.

From the Advanced Query search field, to search for communications containing whitelisted headers, use the following attribute:
texts.sys.content:"<attr-name> : <attr-value>"

Deprecated

The following attribute that was previously used to search for such communications is now deprecated:
texts.sys.attrs:"<attr-name>_<attr-value>"

Note

To add any additional headers to the list of whitelisted headers, contact Smarsh support. The following header will be whitelisted by default for all customers. Users can search for all out-of-office related email communications using the following header:

X-Auto-Response-Suppress

Specify X-Auto-Response-Suppress in the Must have all of these keywords under the List of Terms or in Advance Query field.
Enable the System check box in the Where to Search pane.

Specifying X-Auto-Response-Suppress in the Must not have all of these keywords field will return emails other than Out of office related emails.