With the Determination feature, search and intervention operations can be performed on suspicious emails that have not been reported by users. When the Determination feature is activated, an operation is initiated in the mailboxes of users who have Outlook running.
Creating Determination
To create a determination, click the Create Determination Engine button, as highlighted in the visual.
To create a determination, you must first enter a name and description for the determination.
With Match Criteria, conditions for determination are set. At this stage, one or more conditions can be used. As shown in the example, all emails within the mailboxes containing “example” in the subject line will be displayed and actions can be applied to them.
During the execution of a determination, specific fields of email can be selected for action. These fields include Message ID, From, To, CC, Subject, Body, and Attachment Name.
Conditions can be used as Equal, Not Equal, Contains, and Not Contain.
For Equal, the entered value must exactly match the value being searched for. For example, in a determination where the condition is Message ID and Equal, the Message ID must be identical to the searched value. The opposite of this condition is the Not Equal condition.
Contain condition allows the system to display emails where the searched value (e.g., “test”) appears in fields such as subject, sender, or recipient. For example, if “test” is searched within the subject field, it enables actions to be applied to all emails that contain this value. Not Contain condition is the opposite, where emails that do not include the specified value in fields such as subject, sender, or recipient are displayed and available for action.
Life Time is used to determine how long actions will remain active once a determination is created and applied. This duration can be set between 1 and 30 days. The purpose of this is to ensure that the selected actions can be executed in the mailboxes of users whose Outlook applications are closed.
Date Range is used to define the time period during which the determination scan will be conducted. The options for the date range include Last 24 hours, Last week, Last month, and Custom Date Range.
After the determination is initiated, the first section you will encounter is Engine Information. This section includes details such as the name and description of the determination, the start date, the condition it was created with, the Life Time information, and the Date Range details.
Add Execution section, the desired actions can be selected. These actions are the same as those available under Incident Management and include: Find, Delete, Quarantine, Move to Spam, Move to Inbox, Unlink, Link, and Inform.
Created Executions lists the actions that have been applied. Additionally, it provides information about which mailboxes the actions were applied to and the number of emails within those mailboxes.
The number displayed under Modified represents the total number of emails in the mailbox. Importantly, only the most recent 10 emails from this mailbox are shown in the interface.
Duration of the determination process varies depending on the number of users it is applied to. To review the results, after selecting Determination from the main menu, you can access general information regarding the actions taken, the total number of executions, and the number of mailboxes affected.
You can navigate to the determination details to apply a new action by using the Action button. To delete a determination, you can also select Delete from the Action button options.
