Variable name

Variable value

Notification subjects

%ACTION%

Action taken on a message by the application (Message allowed in, Message deleted, Message blocked).

Infected objects, Attachment filtering, Spam and fishing

%ASBASES_ISSUE_DATE%

Release date and time of the Anti-Spam databases with which the message was scanned.

Spam and phishing

%AVBASES_ISSUE_DATE%

Release date and time of the anti-virus databases with which the object was scanned.

Infected objects, Attachment filtering

%BACKUP_STATUS%

Status of scanned object copying to Backup (Object moved to Backup, Object not moved to Backup).

Infected objects, Attachment filtering, Spam and fishing

%CC%

Email address or list of email addresses specified in the "Cc" field of the message.

Infected objects, Attachment filtering, Spam and fishing

%DELETED_OBJECT_LIST%

List of names of attachment files removed from email messages. The full path to the file location in the attachment is specified for each file.

Filtering of attachments

%DETECTED_FILE_AND_FILTER_LIST%

List of file names of attachments detected during attachment filtering. A criterion for the triggered filtering rule is pointed out for each file.

Filtering of attachments

%FROM%

Email address specified in the "From" field of the message.

Infected objects, Attachment filtering, Spam and fishing

%HEADERS%

Contents of X-headers of the message.

Infected objects, Attachment filtering, Spam and fishing

%OBJECT_ACTION%

Action taken on the object being scanned (Object disinfected, Object deleted).

Infected objects

%OBJECT_NAME%

Name of the infected or password-protected object (such as an attachment).

Infected objects

%OBJECT_THREAT_NAME%

Name of the detected threat.

Infected objects

%RECV_TIME%

Date and time (UTC) the message was received by the Microsoft Exchange server.

Infected objects, Attachment filtering, Spam and fishing

%RULE_NAME_LIST%

List of names of the triggered attachment filtering rules.

Filtering of attachments

%SUBJECT%

Contents of the "Subject" field of the message.

Infected objects, Attachment filtering, Spam and fishing

%TO%

Email address or list of email addresses specified in the "To" field of the message.

Infected objects, Attachment filtering, Spam and fishing

%VERDICT%

Result of a virus scan of the message (Infected, Disinfected, Probably infected, Password-protected) or result of a message scan by the Anti-Spam module (Spam, Probable spam, Phishing, Mass mail).

Infected objects, Spam and phishing