Access to MirrorWeb Insight Communications Search.

Permission to run and save searches.

Add keyword groups and rules using AND / OR.

Scope terms to fields such as All fields, Subject, or Body.

Add sender and recipient filters, and choose Includes or Excludes.

Use Any or All matching based on how strict the query should be.

Select the platforms to include in scope.

Filter by flagged status, review status, and user actions (for example viewed, escalated, or flagged by a reviewer).

Include or exclude privileged and marketing addresses when needed.

Select a required start and end date, or use quick ranges.

Optionally sample by percentage or fixed count.

Choose sort order (Newest or Oldest).

Use Estimate to preview result volume.

Use Save Template for repeatable searches.

Use Save to Vault when preserving a result set for investigations.

Select Search to execute the query.

Start broad, check estimate volume, then tighten filters to reduce false positives.