AntiVirus blocking software emails. How to narrow down how/why?

[ThatDudeFromNZ]

Fortigate 60E updated recently to 6.4.2

Using payroll APP which has Cloud email option to send out payslips. This used to work prior to update, realized if you disable anti virus on the internet policy it sends emails again. Trying to fine tune and put an allow policy for these emails in front of the internet policy. Problem is I'm not sure how/where to view the event that's getting blocked, nothing shows within log&report-->Antivirus even though internet policy set to log off. Any ideas how I can narrow down what exactly it's blocking so I an make an exemption policy? looks like the update modified the layout of things a bit.