Tokens in Content Rules and Policy References

The following tables provide a full list of tokens that can be used in certain What To Do? actions and Policy References.

Token Description/Value Where it can be used...
%ADMIN%

The administrator account email address used by the Policy Engine.

Alerts, Annotations, Informs, Logs, Tag Subject, Add Header
%ALARM_DESCRIPTION%

The description of the raised alarm.

Email Alarm Messages
%ALARM_TEXT%

The text of the raised alarm.

Email Alarm Messages
%ALARM_TYPE%

The type of the raised alarm.

Email Alarm Messages
%AREANAME%

The name of the message area containing the message.

Alerts, Informs. Logs
%DATE%

The date the original message was sent.

Alerts, Annotations, Informs, Log Message, Tag Subject, Add Header, Notify Sender, Notify Auditor

%DETECTED%

Items detected by the What To Look For? clauses in invoked content rules.

Alerts, Annotations, Informs
%HOSTNAME%

The hostname of the machine on which an alarm has been raised.

Email Alarm Message
%IPADDRESS%

The IP address of the machine on which an alarm has been raised.

Email Alarm Message
%LOCALDATE%

The date the original message was sent, shown in the Gateway's local timezone.

Alerts, Informs
%MANAGE_MESSAGE%

A manage message link that can be added to a Plain Format inform message. This token is only applicable to Secure Email Gateway and Secure Exchange Gateway. For example, this token should not be used in informs if Secure Email Gateway and Secure Web Gateway are peered.

Informs
%MODIFIED%

Content rules that triggered, and hence modified the message.

Annotations, Informs
%POLICY%

A list of the content rules invoked on the message.

Alerts, Annotations, Informs, Logs, Tag Subject, Add Header, Notify Sender
%POLICYVIOLATED%

The policy that was violated.

Notify Auditor
%PRIMARYTHREATS%

The threat type and name detected in a message. The values are separated by a colon, for example, VIRUS:EICAR.

Alerts, Informs
%RCPTS%

A list of the recipients. (This is a concatenated list of all the "Recipient" responses.)

Alerts, Annotations, Informs, Logs, Notify Sender, Notify Auditor

%RECOGNISED%

A list of the Gateway format managers that recognized formats in the message (such as SMTP, text, HTML).

Annotations, Informs
%REMOVEDNAMES%

A list of the names of any removed attachments.

Annotations, Informs, Tag Subject, Add Header
%RESPONSES%

The values of all the response tokens.

Annotations, Informs
%SENDER%

The email address of the sender of the original message.

Alerts, Annotations, Informs, Logs, Tag Subject, Add Header

%SERVER%

The Gateway server email address.

Alerts, Annotations, Informs, Logs, Tag Subject, Add Header
%SUBJECT%

The subject of the original message.

Alerts, Annotations, Informs, Logs, Tag Subject, Add Header, Notify Sender, Notify Auditor

%UNIQUEID%

The Mail ID: a unique ID the Gateway assigns to a message.

Alerts, Annotations, Informs, Logs, Tag Subject, Add Header

Tell me about...