Message Attribute Lookup Examples

These examples illustrate the various operators in Message Attribute lookup commands.

The example below example detects all DRM-protected emails:
```
msgattr WHERE isDRMProtected
```
Note: DRM-protected emails cannot be detected by the CA DataMinder Notes endpoint agent or Domino server agent.
The example below detects all digitally signed emails:
```
msgattr WHERE isSigned
```
The example below detects all encrypted emails:
```
msgattr WHERE isEncrypted
```
The example below detects all outgoing emails bigger than 50 KB:
```
msgattr WHERE msgsizekb > 50
```

The example below exempts all meeting requests and responses to meeting requests:

msgattr WHERE messageclass IS ANY ("IPM.Schedule.Meeting.Request","IPM.Schedule.Meeting.Resp.*")

The example below detects all outgoing emails where the total message impact exceeds 1 MB:
```
msgattr WHERE msgimpactkb > 1000
```
The example below detects all outgoing emails with 10 or more recipients:
```
msgattr WHERE recipnum >= 10
```
The example below detects all outgoing emails sent to more than ten internal addresses:
```
msgattr WHERE internalrecipnum > 10
```
The example below detects all outgoing emails sent to more than one external addresses:
```
msgattr WHERE externalrecipnum > 1
```

The example below detects all outgoing emails from specific users at Unipraxis to any user at CA.

msgattr WHERE (%sender% IS ANY {"srimmel@unipraxis.com","lstee@unipraxis.com"}) 
AND (%recipient% labeled %which_recip% IS "@ca.com")

The example below detects all outgoing emails sent to 20 or more recipients in the To list:
```
msgattr WHERE tonum >= 20
```
The example below detects all outgoing emails with no recipients in the Cc list:
```
msgattr WHERE ccnum = 0
```
The example below detects all outgoing emails that do not have one recipient in the Bcc list:
```
msgattr WHERE bccnum <> 1
```
The example below detects all outgoing emails where the total number of To and Cc recipients is over 20:
```
msgattr WHERE toccnum > 20
```
The example below detects emails where the importance 'is not low'. In effect, it excludes emails with low importance and detects emails with normal or high importance:
```
msgattr where importancelevel <> 0
```
The example below detects confidential emails with high importance:
```
msgattr where sensitivitylevel = 3 and importancelevel = 2
```
The example below detects urgent emails:
```
msgattr where prioritylevel = 1
```