Processed report

The Processed report shows messages that have been processed by Sophos Email. If a message is sent to more than one recipient, there's only one row for that message.

Quarantine summary emails sent to your users don't appear in this report.

Table

For each processed message, the report shows the following details:

• Direction: Inbound or Outbound. Click the arrows to sort the rows.
• Sender: The email address of the sender.
• Recipients: The email addresses of the recipients.
• Type: The type of message, either "Gateway" or "Mailflow".
• Subject: Click the subject of a message to see its details.
• Last Status: The most recent activity for the message. See Last Status.
• Date: The date of the most recent activity for the message.
• Category: The category of the message. See Message Categories.

Last Status

The possible values for Last Status can be as follows.

• Deleted: The message was deleted due to its content or your block list configuration.
• Quarantined: The message was marked as spam due to its content or your block list configuration. You can view quarantined messages on the Quarantined Messages page.
• Bounced: The message was returned to the sender, with a reason for not delivering it.
• Redirected: The message wasn't delivered to the original recipient. It was redirected to another email address.
• Processing: The message is still being processed. This applies to messages in the sandbox environment and messages queued for delivery.
• Accepted: The message was received successfully and is being processed by our system.
• Delivery Successful: The message was processed successfully and sent for delivery.
• Delivery Failed: The delivery of the message was attempted several times, but it couldn't be delivered, and the request timed out.

• Queued for Delivery: The initial delivery attempt failed, and the message is re-queued for delivery.

  We attempt to deliver inbound messages for up to five days and outbound messages for up to one day. Possible reasons for failure are the recipient mail server being offline, or issues retrieving the recipient's DNS records. Messages queued for delivery that are now in the processing phase show as "Processing".

• Processing Encryption: The message is still in the process of being push encrypted, or the push encrypted message is waiting to be delivered after the recipient sets their password.

• Encrypted Delivery: A message encrypted by Push Encryption was delivered.
• Portal Delivery: A message encrypted by Portal Encryption was delivered to the Sophos Secure Message portal.
• TLS Delivery Failed: The outbound messages that couldn't be delivered securely using TLS.
• Returned to M365: A Sophos Mailflow email was successfully returned to Microsoft 365.
• Queued for return to M365: A Sophos Mailflow email was put in a queue to be returned to Microsoft 365.
• Failed to return to M365: A Sophos Mailflow email couldn't be returned to Microsoft 365.
• Clawback Successful: The message was successfully clawed back to post-delivery quarantine after being delivered to recipients.
• Clawback Initiated: The process to claw back the message has been initiated.
• Clawback Failed: The attempt to claw back the message failed.
• Clawback Released: The clawback request has been canceled or released. The message won't be clawed back.

Redeliver messages

If you have a Sophos Email Plus license, you can redeliver one or more inbound messages from the last 90 days.

Redelivering a message attempts to deliver the original email to the intended recipients again, even if it was previously delivered successfully. This can be useful if, for example, a recipient's mail server was temporarily unavailable and a message wasn't delivered.

If you redeliver a message that was previously undelivered, it's sent again in its original form. However, if the message was previously delivered successfully, the redelivery creates a new email with the original message attached and sends it to the original recipients. This ensures that recipients can distinguish it from the original delivery.

To redeliver messages, do as follows:

1. Select one or more messages.
2. Click Redeliver email.

The message is redelivered to its original recipients.

Initiate clawback

You can manually claw back messages from recipients' mailboxes and move them to post-delivery quarantine.

When you claw back a message from its Message Details page, you can also claw back copies that were forwarded or replied to internally. Internally forwarded messages can only be clawed back if they were successfully delivered to Microsoft 365 mailboxes in domains connected for post-delivery protection (PDP).

This feature applies to individual recipients, email aliases, and distribution lists. After a successful clawback attempt, the clawback status for distribution lists remains "Clawback Initiated".

You can report a message to SophosLabs and claw it back at the same time. Clawback starts after you submit the message to SophosLabs, as long as it was successfully delivered to a supported mailbox.

A detection is sent to MDR if you select a reason during clawback. The reason appears as a suffix in the Detection Rule column on the Detections page in the Threat Analysis Center.

After a successful clawback, the messages are quarantined. You can check the messages in the post-delivery quarantine list and release them if they're non-malicious or legitimate. For more information, see Quarantined Messages.

You can also claw back messages from a recipient's inbox using the clawback API. For more information, see Email Management API.

You can perform on-demand clawback in two ways:

• Claw back messages in Message History
• Claw back messages in Message Details

Requirements

Before you perform a clawback, make sure you meet the following requirements:

• On-demand clawback must be turned on in the post-delivery protection settings.

  To turn on this setting, see On-demand clawback.

• The message must be delivered to a mailbox in a domain connected for post-delivery protection.

Limitations

Before you perform a clawback, review the following considerations and limitations:

• It may take up to 10 minutes to claw back a message. Delays can occur during mailbox provider processing.
• When a message is clawed back, all messages forwarded or replied to internally are also clawed back.
• If you select only specific recipients during manual clawback, only messages forwarded or replied to internally for those recipients are clawed back.
• A message and any messages forwarded or replied to internally can only be clawed back once. If they're released from post-delivery quarantine, you can't claw them back again.
• Messages sent to external mailboxes may appear in the results. However, you can only perform clawback and other post-delivery actions on mailboxes within domains connected to Sophos Fusion.

Claw back messages in Message History

You can claw back messages directly from Message History.

Show me how

To do this, do as follows:

1. In Sophos Fusion, go to Reports > Email Security Logs > Message History.

2. Select the messages you want to claw back.

   Any messages forwarded or replied to internally are included in the same clawback action.

   Tip

   • You can use Advanced Search to narrow down your message selection.
   • You can use the checkbox next to the up/down arrow icon to select all messages on the current page. Make sure you're viewing only inbound messages, as only those can be clawed back.
   • You can filter for delivered messages because only messages delivered successfully can be clawed back.

3. Click Initiate clawback.

   The Clawback messages dialog appears.

4. (Optional) Select a reason for clawing back the selected messages from the following options:

   • Spam emails
   • Malware emails
   • Phishing emails
   • Unwanted emails

5. (Optional) If you selected Spam emails, Malware emails, or Phishing emails, you can select Report the emails to SophosLabs to report the messages to SophosLabs.

   This helps us improve our threat detection.

6. Click Confirm to claw back the selected messages.

You can view detailed clawback status information in the Additional details column on the Message Details page.

Claw back messages in Message Details

You can claw back messages from their message details page.

Show me how

To do this, do as follows:

1. In Sophos Fusion, go to Reports > Email Security Logs > Message History.
2. Click the subject of a message you want to claw back to view its message details.

3. Select the recipients from whom you want to claw back the delivered message.

   If the message has messages forwarded or replied to internally, you can select recipients in the Internal forwards table to claw back those messages along with the original message. See Internal forwards.

4. Click Initiate clawback.

5. Select a reason for clawing back the selected message from the following options:

   • Spam emails
   • Malware emails
   • Phishing emails
   • Unwanted emails

6. (Optional) If you selected Spam emails, Malware emails, or Phishing emails, you can select Report the emails to SophosLabs to report the message to SophosLabs.

   This helps us improve our threat detection.

7. (Optional) Click View Report to view the post-delivery summary report for the messages clawed back. See Post-Delivery Summary Report.

8. Click Clawback to claw back the message from the selected recipients.

You can view detailed clawback status information in the Additional details column.

Filter messages

You can use the Filter panel on the left side of Message History to refine the list of displayed messages. This helps you quickly narrow down results without using Advanced Search.

You can filter messages by the following criteria:

• Category: Filter by categories such as Spam or Malware.
• Status: Filter by delivery status such as Delivery Successful or Quarantined.

• TLS encryption: Filter messages based on how they were encrypted during delivery.

  Note

  In Gateway mode, TLS encryption refers to the connection between Sophos Email and the external sender or recipient.

  In Mailflow mode, TLS encryption refers to the connection between Sophos Email and Microsoft 365 through the configured connector.

  • Unencrypted: Messages delivered without using TLS encryption.
  • Encrypted: Messages encrypted using TLS version 1.2 or 1.3.

You can apply multiple filters at once. After you've selected the filters, click Apply to update the report. Click Reset to clear all filters.

Use advanced search

In Message History, you can use Advanced Search to filter and find specific messages.

Click Advanced Search to begin.

You can filter messages by the following search fields:

• From: Sender. Supports partial strings. Not case sensitive.
• To: Recipient. Supports partial strings. Not case sensitive.
• Subject: Supports partial strings. Not case sensitive.
• Message size: Greater than or less than a number of MB. This uses the MIME size of an email, which may be greater than the raw file size. See Calculating email attachment file sizes.
• Attachment: Type of attachment. Supports partial strings.

• DSN code: Select a delivery status notification (DSN) code.

  You can enter an entire DSN code, or select one of the following options:

  • 2.*.*: Successful delivery
  • 4.*.*: Transient failure
  • 5.*.*: Permanent failure

You can configure several search criteria. The search results will include messages that match all criteria.

You can also filter messages by Type, Direction, Category, Status, or TLS encryption.

If you change the date range or filter the messages, you must click the Refresh icon to update the search results.

In your search results, the parameters you selected appear in the search box. You can click individual parameters to remove them from the search. Your search results are updated immediately.

You can click the direction arrow to limit your search to inbound or outbound messages. The down arrow is for inbound messages, and the up arrow is for outbound messages. If you click a direction arrow, your search results are updated immediately.

Schedule a report

You can schedule the Processed report as a custom report. Save as Custom Report lets you save the Processed report using the "Message History" template on the Reports page.

Show me how

For more information on saving or scheduling reports, see Email reports.