What is an email-security log?¶

An email-security log records how a gateway or protection service assessed and handled a message. It does not alone prove the message was malicious or that a recipient opened or acted on it.

Product stages and verdicts differ¶

Receipt, scan, quarantine, delivery, rejection, link checking and sandboxing may be separate events. Records can contain message ID, sender, recipient, source, subject, attachments, URLs, rule, verdict and time. “Delivered” may mean mailbox acceptance; “clicked” can describe a security scanner; verdicts can change.

Link message processing to user activity¶

Identify product and stage and preserve original message, headers, attachment hashes, URLs, rules and reclassification where lawfully available.

Correlate mailbox audit, identity, endpoint, browser and network records before concluding open, click or execution.