Patent ID: 7647398

Claim:
A method of logging an e-mail event in an organization to facilitate later access by an administrator for e-mail messaging security associated with a malware scanning system, said method comprising: assigning to each of a plurality of users in said organization a group affiliation, each group being associated with a group identifier, such that each user has a group identifier; assigning said administrator in said organization a plurality of groups for which said administrator manages e-mail events, wherein said administrator has an administrator identifier, said administrator identifier being associated with a plurality of group identifiers of the groups said administrator manages; receiving said e-mail event in a computer system of said organization, said e-mail event being associated with one of said users; determining at least one current malware policy associated with said group identifiers; scanning an e-mail associated with said e-mail event for malware using said at least one current malware policy; storing said e-mail event on a server computer of said computer system; determining a user group identifier corresponding to the group to which said user belongs; determining a plurality of parent group identifiers corresponding to groups within said organization that subsume said group to which said user belongs; forming a message group set that includes said user group identifier and said parent group identifiers; storing at least a portion of said e-mail event in an entry in an event log and including said message group set in said entry and at least one current malware policy name, and comparing said user group identifier stored in said entry of said event log and said group identifiers associated with said administrator identifier to determine whether to allow the administrator later access to said e-mail event.