Access to MirrorWeb Insight and relevant permissions for this workflow.

Choose a field to search: All fields, Subject, Body, etc.

Enter relevant keywords or phrases (e.g., "insider trading")

Filter by Senders and/or Recipients email addresses

You can toggle recipient filtering between "Any" or "All" if using multiple addresses

Please note: If you enter the same person in both the Senders and Recipients fields, the search will only return messages where that person sent a message to themselves, not all messages they sent or received.

Select one or more communication platforms (e.g., Email, Slack, Teams) to narrow your search scope

Select a start and end date

Or use one of the quick-select options: Today, Yesterday, Last Week

This sets the bounds of your search query

Choose whether to search:

Optionally check Include privileged addresses to include communications flagged as privileged (e.g., legal, confidential)

Apply a sample size to reduce the result set if needed.

Choose to view results by:

Estimate: Click this to generate a preview estimate of how many messages match your criteria—before actually running the search.

Save Template: This saves your current filter configuration so you can reuse it for future searches.

Search: Runs the search and returns matching communications.

Save to Vault: Use this to archive and preserve the search results for formal investigations, audits, or legal review.

Start with broader filters to preview the scope of your results with Estimate, then narrow down.

Save reusable templates to streamline recurring audits or investigations.

When reviewing large datasets, use sampling to test filters before scaling up.

Double-check that the date range includes expected messages.

Ensure your keywords match message content (try fewer or broader terms).

Make sure the platforms selected actually contain archived messages from that time period.

Consider running the search with privileged addresses enabled if you expect confidential comms.