The Email Alerts: Email Analysis page of the Email Security - Server appliance lists the results, grouped by sender, of the matched URLs that are embedded in PDF and Microsoft Office files, and that are sent back to the URL analysis service for further analysis.
To view the malicious embedded URL details grouped by sender:
In the Web UI, click the eAlerts tab.
Click Sender.
Click the total number of attachments link in the Attachment column.
To expand an entry for multiple alerts (if present), click the circled blue plus sign in the first column to show the individual alerts in the grouping.
To expand the row to show detailed results, click the ID number in the ID column or the type name in the File Type column.