For high-risk anomalies (e.g., an executive receiving an encrypted zip file from a first-time sender), Sentinel places the email in a temporary "Investigative Hold."
By running zmmsgtrace via CLI, an admin can track: zimbra mail police
When the GUI is too slow, the Police unleash the command line. These are the attack dogs. For high-risk anomalies (e