Message Tracking can be used to locate messages in mimecast.  You can the gather more intelligence about the message once you learn how to use Message tracking. The following are the steps to locate messages in Mimecast.


  1. Log into Mimecast Administration Console.




  2. On the top bar click on the Administrator drop down.



  3. Click on the Message Center button.



  4. From the options click on Message Tracking.



  5. Fill in relevant information to find email in question. Search for Sender email or the recipent email.  Be sure to set the date range to cover when the email would have been sent.



  6. On the results page you will be able to filter by subject. The list of users who the email was sent to will be on this page.



  7. Locate the email you are looking for and click on it.  This will bring up a pop up with more details about the message. You are able to research the following tabs: Messages, Analysis, Transmission Data, and Policies.  This information can help with forensic investigations.



  8.  The analysis tab allows you to see what spam score of the message and the processing details of the received email.



  9. The header tab provides you with the ability to copy the header and analyze it on https://mxtoolbox.com/EmailHeaders.aspx



  10. The transmission tab helps break down more intelligence.  You can use https://www.virustotal.com/gui/home/upload to scan details on this page like IP's addresses and URL's.



  11. The final page is only available when you switch to delivered view.  It reveals the policy that the message is held against by Mimecast when the email is received.