How to get e-mail forensic data using the query syntax?

[Evren_Buyer]

Hi Everyone !

I'm new to Threat Emulation (TE) and just located my GW as next hop MTA and started to use TE in the middle of my mail system as best practices overview.

Internet-->SMTP Security GW ---> CP MTA (Threat Emulation,Threat Extracion, Anti-Spam, E-Mail Security BLADES ON)---> Exchange Server ---> E-Mail Client

My question is to get forensic data those mails pass through the CP Threat Prevention system.

When I made a query in the log according to the sender address like below is available to be filtered, but when I try to make a query according to receipent I'm getting thousands of internal user data, cause my AD name the as my e-mail address...

I researched the query methods and in the query pane "other filelds" I found out "email_address:" and tried to make a query with that but no success !!! Nothing came out....

For e-mail forensic like blocked and extracted e-mails I need to make queries according to e-mail receipent, e-mail sender, e-mail subject, all of them etc... Does anyone know how to do that? I also have Smart Event license and server...