Using Tokens in Content Rules and Policy References

The following tables provide a full list of tokens that can be used in certain What To Do? actions and Policy References.

Token Description/Value Where it can be used...
%ADMIN%

The administrator account email address used by the Policy Engine.

Alerts, Annotations, Informs, Logs, Tag Subject, Add Header
%ALARM_DESCRIPTION%

A description of the raised alarm.

Email Alarm Messages
%ALARM_TEXT%

The text of the raised alarm.

Email Alarm Messages
%ALARM_TYPE%

The type of the raised alarm.

Email Alarm Messages
%AREANAME%

The name of the message area containing the message.

Alerts, Informs. Logs
%CONTENTDETECTED%

The names of the triggered content rules.

Informs
%DATE%

The date the original message was sent.

Alerts, Annotations, Informs, Log Message, Tag Subject, Add Header, Notify Sender, Notify Auditor

%DETECTED%

Items detected by the What To Look For? clauses in invoked content rules.

Alerts, Annotations, Informs
%HOSTNAME%

The hostname of the machine on which an alarm has been raised.

Email Alarm Message
%IPADDRESS%

The IP address of the machine on which an alarm has been raised.

Email Alarm Message
%LOCALDATE%

The date the original message was sent, shown in the ARgon Server's local timezone.

Alerts, Informs
%MANAGE_MESSAGE%

A manage message link that can be added to a Plain Format inform message.

Informs
%MODIFIED%

Content rules that triggered, and hence modified the message.

Annotations, Informs
%POLICY%

A list of the content rules invoked on the message.

Alerts, Annotations, Informs, Logs, Tag Subject, Add Header, Notify Sender
%POLICYVIOLATED%

The policy that was violated.

Notify Auditor
%PRIMARYTHREATS%

The threat type and name detected in a message. The values are separated by a colon, for example, VIRUS:EICAR.

Alerts, Informs
%RCPTS%

A list of the recipients. (This is a concatenated list of all the "Recipient" responses.)

Alerts, Annotations, Informs, Logs, Notify Sender, Notify Auditor

%RECOGNISED%

A list of the Clearswift ARgon for Email format managers that recognized formats in the message (such as SMTP, text, HTML).

Annotations, Informs
%RELEASEDBY% The name of the person who released the message. Notify Auditor
%REMOVEDNAMES%

A list of the names of any removed attachments.

Annotations, Informs, Tag Subject, Add Header
%RESPONSES%

The values of all the response tokens.

Annotations, Informs
%SENDER%

The email address of the sender of the original message.

Alerts, Annotations, Informs, Logs, Tag Subject, Add Header

%SERVER%

The Clearswift ARgon for Emailserver email address.

Alerts, Annotations, Informs, Logs, Tag Subject, Add Header
%SUBJECT%

The subject of the original message.

Alerts, Annotations, Informs, Logs, Tag Subject, Add Header, Notify Sender, Notify Auditor

%UNIQUEID%

The Mail ID: the unique ID Clearswift ARgon for Email assigns to a message.

Alerts, Annotations, Informs, Logs, Tag Subject, Add Header

Tell me about...