CyberGraph 2.0 - Dynamic Banner Search

This article provides information on CyberGraph's Dynamic Banner Search feature. 

Overview

The Dynamic Banner Search feature for CyberGraph is a troubleshooting tool that can assist CyberGraph Administrators in better understanding why certain messages did or did not receive a banner, or why a specific type of banner was received. Using Dynamic Banner search, an administrator can enter certain criteria to find a specific CyberGraph processed message or a set of them that match the criteria.

Search

To search for Banners, fill in the following details after navigating to how to CyberGraph | Banners | Search within the Mimecast Administration Console.  

1. Date range: A user-friendly tool designed for selecting a range of dates, allowing users to easily specify start and end dates.

The date range default is set to Last 24 hours.

2. Field. This can be either: 

• • • Sender
    • Recipient
    • Severity
    • Subject
    • Rules
    • Reason

3. Operator: This can be either: 

• • • Equal to
    • Contains

*Administrator can choose either one depending on the field chosen.

4. Expression or Value: Enter the search data to correspond with the previous fields.
5. Criteria: This can be used to add additional search criteria. There is no limit to the number of criteria that can be added.

6. The criteria will be added to the Query View section. You can choose to add further criteria, and when you are ready to search, select the Search option. The results will be displayed below the search form and include the details shown here:

Viewing Search Results

Results:

The results will be displayed below the search form as indicated below.

1. If you hover over the entry in the Rule column, if multiple rules were triggered, they will be listed.
2. The results list will include all messages for which the CyberGraph rules executed. This is likely to be different than the message banners delivered to the end user, due to cases where the banner was suppressed and not delivered. The search results include all processed messages, whereas delivered bannered messages are likely to be a subset. Reasons for banner suppression: CyberGraph 2.0 - Configuration Settings for more about the Targeted Bannering (AI Assist) feature.
3. For example, a search result entry could indicate that the severity of a message banner is classified as Info. The reason for this classification could be attributed to AI. However, the user would not see the banner in this message because it is suppressed by the Targeted Banner setting mentioned earlier.

Reason:

1. Reasons codes:
   •  
     • Whitelist Rule(s) Failed
     • Strong Communication
     • Whitelisted
     • Content
     • Rule(s) Triggered
     • Blacklisted
     • No Warnings

1. Rule(s) Triggered: One or more rules have been triggered. Hover over this label to see a list of rules.
2. AI: This means that the Targeted Banner setting is enabled, but the banner has been suppressed.
3. Whitelist Failed: Even though the sender was safelisted, SPF rules may have been triggered, which will override the safelist and activate the rules.

Export

1. After the search results are displayed, you can export them to a .csv file as shown below:

2. You can save the export file to a chosen file system location by selecting the Export Data button at the top of the search results.

The maximum number of records you can export is 15,000. If you need to export more than 15,000 records, consider modifying your search criteria and exporting the remaining data as a separate file.