Investigation Tool Recipe: Locate Emails Containing a Specific Word or Phrase

Problem 

You need to search all user mailboxes for emails containing a specific word or words. Investigating emails containing the word password may help you discover phishing attempts.

In this example, we'll look for emails containing the words, stolen password.

Steps

1. Open the Investigation Tool.
   Security > Security center > Investigation tool
2. Search for or select from the drop-down Gmail messages as your data source.
3. Click Add Condition.
4. Add the following condition:
   All content > Contains word > stolen password.
5. Click Search. The results appear at the bottom of the page.
   
6. To take action on the emails, select the checkbox for one or more message.
7. Click Actions at the top of the grid.
8. Select the appropriate action: View header, Delete message, Mark message as phishing, Mark message as spam, Restore message, Send message to inbox, Send message to quarantine. 
   
9. If you are happy with the investigation you built and want to retain it, click Save Investigation, located on the right.

See our full list of Investigation tool recipes. 

Document Version	Date	Description of Change
1.0	1/10/2024	Original Publish