Searching quarantine

Procedure

1. In Cloud App Security, go to Operations → Quarantine
2. Select an organization to view the quarantine data of the organization or All organizations to view the aggregated data of all the organizations.

   Note To view aggregated quarantine data of specific organizations, select All organizations and then specify the organizations from the facet area.

3. Select the service to query.
4. Specify search criteria in either of the following ways.
   • Quickly specify search criteria by using the facets in the left panel.
     For more information on quarantine facets, see Quarantine facets.

     Note A maximum of 10 affected users can be displayed under Affected User.

   • Specify search fields and values in the search bar. This allows you to select one or several fields to query items on a more fine-grained level.
     Search fields vary with each service you select.
     The following rules apply to the search:
     • The NOT logic is not supported.
     • Values are case insensitive.
     • Wildcards are not supported.
     • One facet can be selected for more than one time and specified with different keywords as necessary. The email messages or files that meet either keyword will be queried and displayed. When different facets are selected and specified, only the email messages or files that meet all the facets will be queried and displayed.
     • Partial matching is supported except for the Organization field and time related fields. You can select a field and type the first few letters of a keyword to query.
     • Only exact matching is supported for the Organization field and time-related fields. You need to type the time exactly in the MM DD, YYYY HH:MM format you see in the corresponding column.
       This includes Timestamp.
     • The All Fields fields supports querying Timestamp and all the other fields.
5. Specify a time range to search.
6. Click Search.