Security Compliance content search

I need to search the body of email for specific word(s). I have created searches but do not see Body as an option when adding conditions.

Who is Participating?
Vasil Michev (MVP)Connect With a Mentor Commented:
Because the new experience in the SCC is focused on more than just email, it covers all workloads now. Thus workload-specific keywords are not always supported. You can always go back to the EAC and run eDiscovery query with the "body" keyword from there, or even use Search-Mailbox.
Vasil Michev (MVP)Commented:
You should be able to use Subject as both keyword and/or condition. How did you create the search? Have you reviewed the documentation, there are multiple examples on how you can use a Subject-based query:
agcsupportAuthor Commented:
@Vasil - I need to search the body of the email not the subject. Message Body is not an option when creating the search.

Content Search\New Search\Add Condition
Vasil Michev (MVP)Commented:
Well, that's what you wrote above:

I have created searches but do not see Subject as an option when adding conditions.

Anyway, the "body" keyword is no longer supported with the new syntax, you can however "exclude" other parts of the message by using the NOT operator. For example:

"bla bla keywords bla bla" NOT subject:"Project X"

Or you can do the same with conditions, which allow you to use the "subject does not equal" clause.
agcsupportAuthor Commented:
You are correct and I have edited the question.

Seems ridiculous that one cannot search the body of an email for a keyword. Why on earth would they allow you to search every other field than the one that contains the most content of an email. Hmmm maybe I just answered my own question. Maybe they don't want to run queries against a field that contains so much data.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.