Variable name

Variable value

Notification subjects

%ACTION%

Action taken on a message by the application (Message allowed in, Message deleted, Message blocked).

Infected objects, Corrupted objects, Protected objects, Attachment filtering, Spam messages

%ASBASES_ISSUE_DATE%

Release date and time of the Anti-Spam databases with which the message was scanned.

Spam messages

%AVBASES_ISSUE_DATE%

Release date and time of the anti-virus databases with which the object was scanned.

Infected objects, Corrupted objects, Protected objects

%AVBASES_RECORD_COUNT%

Number of records in the anti-virus databases.

Infected objects, Corrupted objects, Protected objects

%BACKUP_STATUS%

Status of scanned object copying to Backup (Object moved to Backup, Object not moved to Backup).

Infected objects, Corrupted objects, Protected objects, Attachment filtering, Spam messages

%CC%

Email address or list of email addresses specified in the "Cc" field of the message.

Infected objects, Corrupted objects, Protected objects, Attachment filtering, Spam messages

%DELETED_OBJECT_LIST%

List of names of attachment files removed from email messages. The full path to the file location in the attachment is specified for each file.

Filtering of attachments

%DETECTED_FILE_AND_FILTER_LIST%

List of names of files detected during attachment filtering. The names of filters based on which the file was detected and the full path to the file location in the attachment are specified for each file.

Filtering of attachments

%FROM%

Email address specified in the "From" field of the message.

Infected objects, Corrupted objects, Protected objects, Attachment filtering, Spam messages

%HEADERS%

Contents of X-headers of the message.

Infected objects, Corrupted objects, Protected objects, Attachment filtering, Spam messages

%OBJECT_ACTION%

Action taken on the object being scanned (Object disinfected, Object deleted).

Infected objects, Corrupted objects, Protected objects

%OBJECT_NAME%

Name of an infected, protected, or corrupted object (such as an attachment).

Infected objects, Corrupted objects, Protected objects

%OBJECT_THREAT_NAME%

Name of the detected threat.

Infected objects, Corrupted objects, Protected objects

%RECV_TIME%

Date and time (UTC) the message was received by the Microsoft Exchange server.

Infected objects, Corrupted objects, Protected objects, Attachment filtering, Spam messages

%SERVER_NAME%

Name of the Microsoft Exchange server on which the message was scanned and the threat was detected.

Infected objects, Corrupted objects, Protected objects, Attachment filtering, Spam messages

%SUBJECT%

Contents of the "Subject" field of the message.

Infected objects, Corrupted objects, Protected objects, Attachment filtering, Spam messages

%TO%

Email address or list of email addresses specified in the "To" field of the message.

Infected objects, Corrupted objects, Protected objects, Attachment filtering, Spam messages

%VERDICT%

Result of the virus scan of the message (Infected, Disinfected, Probably infected, Corrupted, Password-protected) or result of the message scan by the Anti-Spam module (Spam, Probable spam, Phishing, Mass mail).

Infected objects, Corrupted objects, Protected objects, Spam messages