%NODE_IP%

IP address of the cluster node that processed the message.

%NODE_PORT%

Connection port of the cluster node that processed the message.

%PRODUCT_NAME%

Application name — Kaspersky Secure Mail Gateway.

%SMTP_MESSAGE_ID%

Message-ID message header.

%SENDER%

Mail sender's address.

%SENDER_IP%

IP address of the message sender

%ALL_RECIPIENTS%

Addresses of all recipients of the original message.

%AFFECTED_RECIPIENTS%

Addresses of the original message recipients affected by the event described in the notification.

%AFFECTED_RULES%

List of triggered rule IDs.

%MESSAGE_ID%

ID assigned to the message by Kaspersky Secure Mail Gateway.

%SUBJECT%

Subject of an original message.

%DATE%

Date when the message was received.

%MESSAGE_ACTION%

Action performed on the message by the application.

Possible values:

• Skipped.
• Disinfected.
• AttachmentDeleted.
• Deleted.
• Rejected.

If the message was placed in Backup, the action is followed by a comma and the words backed up.

%DATA_BEGIN%

Service macro for designating the beginning of the list of attachments.

%DATA_END%

Service macro for designating the end of the list of attachments.

%OBJECT_NAME%

Name of the detected object.

The value of the macro depends on its position in the body of the notification:

• Between %DATA_BEGIN% and %DATA_END% macros, the attachment name is inserted.
• Outside %DATA_BEGIN% and %DATA_END% macros, the Message value is inserted.

In the notification subject, the Message value is inserted in place of the macro.

%OBJECT_SIZE%

Size of the whole message or individual attachments.

The value of the macro depends on its position in the body of the notification:

• Between %DATA_BEGIN% and %DATA_END% macros, the attachment size is inserted.
• Outside %DATA_BEGIN% and %DATA_END% macros, the size of the whole message is inserted.

In the notification subject, the size of the whole message is always inserted for this macro.

%STATUS%

Scan result for the message or attachment.

The value of the macro depends on its position in the body of the notification:

• Between the %DATA_BEGIN% and %DATA_END% macros, Anti-Virus and Content Filtering scan statuses are inserted.
• Outside %DATA_BEGIN% and %DATA_END% macros, whole message scan statuses are inserted (if notification sending is enabled for the relevant statuses in the rule).

  In the subject of the notification, the macro is always replaced with scan statuses of the whole message (if notification sending is enabled for the relevant statuses in the rule).

If there are multiple statuses, they are inserted as a comma-separated list.

%OBJECT_ACTION%

Action performed on the message or attachment by the application.

The value of the macro depends on its position in the body of the notification:

• Between %DATA_BEGIN% and %DATA_END% macros, actions performed by the Anti-Virus or Content Filtering modules (Blocked, Not blocked, Disinfected) are inserted, or an Anti-Phishing action performed on the whole message.
• Outside %DATA_BEGIN% and %DATA_END% macros, the action performed on the whole message is inserted.

  In the notification subject, the action performed on the whole message is always inserted.