Message trace & message details

Monitor › Message trace lists every message Obsidian processed - delivered, tagged, quarantined, rejected, released - and opens the full story of any one of them.

Searching

The search box matches, as you type, any of:

sender (header From or envelope sender) or any recipient - partial text works (contoso, @gmail.com)
subject text
the Message-ID header, or Obsidian's own ID (from the X-Obsidian-ID header or a bounce message)
the connecting client IP, or the Postfix queue ID (from the mail log)

Filters

Verdict: One verdict, or All threats (phishing, BEC, virus, malware). See verdicts.
Action: What happened to the message: delivered, tagged, quarantined, held, rejected, released, deleted, clawed back, tempfail.
Direction: inbound, outbound, or api (API-mode scans).
Period: 1 hour to 90 days, or All. Default 7 days. Messages older than the log retention are gone.
Organization: MSP administrators only.

Changing a filter applies it immediately; the address bar keeps the filter so you can bookmark or share a view.

The list

Received: Local time (hover for seconds), with direction and source (for API scans: m365 / google / exchange).
From: Display name and address.
Subject: With the AI's verdict and risk when the model reviewed it, or "AI review pending".
To: All recipients.
Verdict, Score, Action: See How filtering works. Scores are coloured: red 8+, amber 5+, green 0 or less.

Click anywhere on a row to open the message. Newer / Older page through 50 at a time.

The message page

Header line

Subject, verdict, action, score, the exact time, direction and organization.

AI analysis

When the model reviewed the message: its verdict, risk (0-100), confidence, how long it took, which model, a one-sentence summary and up to five indicators. "AI analysis pending" means a review is queued; held mail is released automatically if it comes back clean.

Why

Every rule that fired, strongest first, with its points, the stage that raised it and its category. The line at the top right states the decision (for example "score 20.9 >= reject threshold 15"). Look up any rule name in the rule reference.

Scan stages

One row per stage with a status dot (green ran, red error, grey skipped), its time and number of findings. Expand a stage to see its raw data - for example the SPF/DKIM/DMARC results, the Spamhaus answers per IP and domain, the ClamAV status, the attachment inventory with file types and nesting, Bayes' probability and top tokens, and why the AI was or was not asked.

Links

Every link host with the full URL and the text shown to the reader - the quickest way to see where a phishing mail really points.

Text preview

The message as plain text. HTML, images and links are never rendered in the console, so opening a malicious message here is safe.

Full headers

The original headers (only while a raw copy is kept - see retention in Settings).

Actions on a message

Release: (Quarantined or held mail.) Delivers to every recipient still quarantined, skipping filtering. Released mail carries X-Obsidian-Released. For API-mode messages it moves the message back to the inbox instead.
Release (per recipient): In the Recipients box, release to one person only.
Delete: Marks the quarantined copies deleted. They can no longer be released by users.
Claw back: (Delivered mail.) Finds the message in every recipient mailbox by its Message-ID through the organization's API connector and moves it out (hidden deleted items by default). Needs a connector with "Allow clawback".
Report spam / Not spam: Trains the Bayes filter (organization and global corpus) and records the report. Needs the raw copy.
Ask AI: Queues an AI review now, whatever the score. The result appears on the page when finished (refresh).
Allow / Block sender: Adds the exact sender address to the organization's allow or block list (global list for mail without an organization).
Allow / Block domain: Same for the whole sender domain (@domain).
Download .eml: Downloads the original message (as .eml.txt so it cannot open by accident). Recorded in the audit log.

Envelope box

From / Envelope: Header From vs. SMTP MAIL FROM - a difference is normal for newsletters, suspicious for "personal" mail.
Client / HELO: The connecting server's IP, reverse DNS name and greeting.
Message-ID, Queue ID: For correlating with the mail platform's own trace and the Postfix log.
Size, Scan time: Message size and how long scanning took.
Policies: Which policy overrides applied.
Reported: If a user or admin reported it as spam / not spam.

Recipients and attachments

Each recipient's own status, whether it is admin-only, and who released it when. Attachments show name, type, size and SHA-256 (useful for threat-intel lookups).