If an email was blocked due to the content, you will not readily see in the logs which keyword expression triggered the action.

To verify the keyword expression, configure a notification for blocked emails:

1. On the policy that detected the email, configure the action to send out a notification to the email administrator. The notification should contain “%DETECTED%”.
2. Resend the email so it will pass through the IMSS or IMSVA server. When the email is blocked again, you will receive a notification with information on the PERL regular expression that triggered the policy.