Cisco Cisco Email Security Appliance C190 ユーザーガイド

If your deployment uses the alias table for alias expansion, the search finds the 
expanded recipient addresses rather than the original envelope addresses. For 
more information about Alias Tables, see “Creating Alias Tables” in the 
“Configuring Routing and Delivery Features” chapter . 

In all other cases, message tracking queries find the original envelope recipient 
addresses. 

The RFC 822 message header. 

SMTP authenticated username of the sender, if the sender used SMTP 
authentication to send the message. Otherwise, the value is “N/A.” 

The names of files attached to the message. 

Messages that contain at least one attachment with the queried name will appear 
in the search results. 

Some attachments may not be tracked. For performance reasons, scanning of 
attachment names occurs only as part of other scanning operations, for example 
message or content filtering, DLP, or disclaimer stamping. Attachment names are 
available only for messages that pass through body scanning while the 
attachment is still attached. Situations in which an attachment name will not 
appear in search results include (but are not limited to): 

if the system only uses content filters, and a message is dropped or its 
attachment is stripped by anti-spam or anti-virus filters

if message splintering policies strip the attachment from some messages 
before body scanning occurs. 

For performance reasons, the names of files within attachments, such as OLE 
objects or archives such as .ZIP files, are not searched. 

Name of the sending host, as verified by reverse DNS (PTR) lookup.

IP address of the sending host.

SenderBase reputation score. The range is from 10 (likely a trustworthy sender) 
to -10 (apparent spammer). A score of “None” indicates that there was no 
information about this host at the time the message was processed. 

For more information about SBRS, see