sophos_search_quarantine
Read-only
Search pre-delivery quarantine messages using structured filters. Filter by date, reason, sender, recipient, subject, attachment, and more to find specific quarantined emails.
Instructions
Search pre-delivery quarantine messages with structured filters. This is the primary way to list quarantined messages.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort fields, e.g. ['quarantinedAt:DESC'] | |
| end_date | No | End date ISO 8601 | |
| page_size | No | Results per page (max 200) | |
| tenant_id | Yes | Tenant UUID | |
| begin_date | No | Start date ISO 8601 (e.g. 2024-01-01T00:00:00.000Z) | |
| filter_reason | No | Filter by quarantine reason (e.g. ['impersonation','spam','malware']) | |
| page_from_key | No | Pagination key from previous response | |
| filter_direction | No | Filter by message direction | |
| filter_to_contains | No | Filter: recipient address contains | |
| filter_from_contains | No | Filter: sender address contains | |
| filter_has_attachment | No | Filter messages that have attachments | |
| filter_subject_contains | No | Filter: subject contains | |
| filter_attachment_name_contains | No | Filter: attachment name contains |