Currently it is not possible to query the logs for the Content Scanning (Spam) detection filter directly from the ScanMail for Microsoft Exchange administrator console.
This article explains different ways to query those logs.
To perform the Content Scanning (Spam) log query, do the steps below:
- Send the logs to Apex Central.
- Send logs via syslog to a third-party log management system.
More information regarding the format of the syslog events sent by SMEX can be found in the following KB article: ScanMail for Exchange (SMEX) 14.0 Syslog content mapping guide